Vulnerability in Kernel: rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
Summary
GSD-2022-1000133: rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink(). Affects Kernel versions >= ba7d49b1f0f8e5f24294a880ed576964059af5ef, < a01e60a1ec6bef9be471fb7182a33c6d6f124e93. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities, such as device drivers, memory management, and process scheduling. The rtnetlink subsystem within the Kernel is responsible for managing network-related operations. It allows users to configure network interfaces, routes, and other networking parameters. However, a vulnerability has been discovered in the rtnetlink subsystem that could potentially lead to security issues.
Vulnerability Detail
The vulnerability, identified as GSD-2022-1000133, resides in the __rtnl_newlink() function of the rtnetlink subsystem. Specifically, it fails to refresh the master_dev/m_ops, which could result in an inconsistent state. An attacker could potentially exploit this vulnerability to execute arbitrary code or trigger a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in version v3.14 of the Linux Kernel and has been fixed in version v4.19.228 through commit a01e60a1ec6bef9be471fb7182a33c6d6f124e93.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the rtnetlink subsystem in the Linux Kernel is vulnerable to a security issue that could potentially allow arbitrary code execution or trigger a denial-of-service condition. It is crucial to update the Kernel to the fixed version to mitigate these risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is yet to be proven. However, it could potentially allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
There is no evidence to suggest that this vulnerability has been exploited in the wild. However, it is always recommended to apply security patches promptly to mitigate potential risks.
At the moment, there are no known workarounds for this vulnerability. It is advisable to update the Linux Kernel to the fixed version as soon as possible.
You can find more information about this vulnerability, including technical details and the fix, in the vulnerability report available at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000133.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
