Information Leakage in /proc/net/ptype
Summary
GSD-2022-1000127: net: fix information leakage in /proc/net/ptype. Affects Kernel versions >= 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50, < b67ad6170c0ea87391bb253f35d1f78857736e54. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel. It provides the core functionality for various Linux distributions. The /proc/net/ptype file is a virtual file that allows users to view the packet types registered in the kernel. It provides information about the registered packet types, including their names and associated protocols.
Vulnerability Detail
The vulnerability identified as GSD-2022-1000127 in the Linux Kernel's /proc/net/ptype file allows for information leakage. An attacker can exploit this vulnerability to gain unauthorized access to sensitive information about the registered packet types. This information can be used to gather intelligence about the system and potentially aid in further attacks. The vulnerability was introduced in version 2.6.26 of the Linux Kernel and has been fixed in version 4.19.228.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version to mitigate the risk of information leakage.
Conclusion
The information leakage vulnerability in the /proc/net/ptype file of the Linux Kernel can lead to unauthorized access to sensitive information. It is crucial to update the Linux Kernel to version 4.19.228 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability allows an attacker to gain unauthorized access to sensitive information about the registered packet types in the Linux Kernel. The leaked information can be used to gather intelligence about the system and potentially aid in further attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. The playground allows you to analyze your manifest file (e.g., package-lock.json) and provides real-time alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is crucial to update the Linux Kernel to the fixed version to mitigate the risk of information leakage.
The vulnerability was introduced in version 2.6.26 of the Linux Kernel and has been fixed in version 4.19.228. Therefore, all versions between 2.6.26 and 4.19.228 (inclusive) are affected.
You can find more information about this vulnerability in the GSD-2022-1000127 JSON report available on the Cloud Security Alliance's GSD Database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000127.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
