net/smc: Fix Kernel Panic Caused by Race of smc_sock
Summary
GSD-2022-1000052: net/smc: fix kernel panic caused by race of smc_sock. Affects Kernel versions >= 5f08318f617b05b6ee389d8bd174c7af921ebf19, < b85f751d71ae8e2a15e9bda98852ea9af35282eb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/smc package is a part of the Linux Kernel ecosystem. It provides support for the SMC (System Management Controller) protocol, which allows for efficient communication between systems. The smc_sock component within this package is responsible for managing SMC sockets. SMC sockets enable communication between two endpoints using the SMC protocol. However, a vulnerability has been identified in the smc_sock component that can lead to a kernel panic due to a race condition.
Vulnerability Detail
The vulnerability in the smc_sock component of the net/smc package arises from a race condition. When multiple threads or processes attempt to access and modify the same smc_sock object concurrently, it can lead to inconsistent state and trigger a kernel panic. This vulnerability can be exploited by an attacker to crash the system, potentially leading to a denial-of-service (DoS) scenario. The vulnerability was introduced in version v4.11 of the Linux Kernel and has been fixed in version v5.15.13.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As this vulnerability has been fixed in the latest version of the Linux Kernel, there is no specific workaround available. It is strongly advised to update to the patched version to ensure the system is secure.
Conclusion
The net/smc package in the Linux Kernel is vulnerable to a race condition in the smc_sock component, which can lead to a kernel panic and system crash. To mitigate this vulnerability, it is crucial to update the Linux Kernel to version v5.15.13 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a kernel panic and subsequent system crash, potentially resulting in a denial-of-service (DoS) scenario.
An attacker can exploit this vulnerability by triggering the race condition in the smc_sock component, causing the system to crash and potentially leading to a DoS scenario.
The vulnerability was introduced in version v4.11 of the Linux Kernel. All versions between v4.11 and v5.15.12 are affected.
Yes, this vulnerability has been fixed in version v5.15.13 of the Linux Kernel.
More information about this vulnerability can be found in the official Linux Kernel documentation and the vulnerability database maintained by the Cloud Security Alliance.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
