Use-After-Free Vulnerability in phylib Package
Summary
GSD-2022-1000199: phylib: fix potential use-after-free. Affects Kernel versions >= bafbdd527d569c8200521f2f7579f65a044271be, < bd024e36f68174b1793906c39ca16cee0c9295c2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The phylib package is a component of the Linux Kernel, which is responsible for managing physical layer devices. It provides a framework for handling various types of PHYs (Physical Layer Interfaces) used in networking. PHYs are responsible for transmitting and receiving data over physical media such as Ethernet cables.
The vulnerability identified in phylib is a use-after-free issue, which occurs when a program continues to use a pointer after the memory it points to has been freed. This can lead to unpredictable behavior, including crashes, data corruption, and potential security vulnerabilities.
Vulnerability Detail
The use-after-free vulnerability in phylib was introduced in version v4.16 of the Linux Kernel by commit bafbdd527d569c8200521f2f7579f65a044271be. It was fixed in version v5.10.96 by commit bd024e36f68174b1793906c39ca16cee0c9295c2.
The vulnerability arises from improper handling of PHY devices in certain scenarios, leading to a situation where a pointer to a freed memory block is still being used. An attacker could potentially exploit this vulnerability to execute arbitrary code, escalate privileges, or cause denial of service.
To exploit this vulnerability, an attacker would need to have local access to a system with a vulnerable version of the Linux Kernel and the ability to execute malicious code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel to a version that includes the necessary patch.
Conclusion
The use-after-free vulnerability in phylib can potentially be exploited by an attacker with local access to a system running a vulnerable version of the Linux Kernel. It is crucial to update the Linux Kernel to version v5.10.96 or later to mitigate this vulnerability. Users can obtain the updated version from the official Linux Kernel repository or wait for their Linux distribution to release an updated package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
phylib is a component of the Linux Kernel that provides a framework for managing physical layer devices, such as PHYs used in networking.
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed. This can lead to unpredictable behavior and potential security vulnerabilities.
To exploit this vulnerability, an attacker would need local access to a system with a vulnerable version of the Linux Kernel and the ability to execute malicious code.
Yes, this vulnerability has been fixed in version v5.10.96 of the Linux Kernel.
There is no known workaround for this vulnerability. It is recommended to update the Linux Kernel to a fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
