Vulnerability in Kernel: net: dsa: ar9331: register the mdiobus under devres
Summary
GSD-2022-1000369: net: dsa: ar9331: register the mdiobus under devres. Affects Kernel versions >= ac3a68d56651c3dad2c12c7afce065fe15267f44, < 475ce5dcf2d88fd4f3c213a0ac944e3e40702970. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the security and stability of the system. The vulnerability in question affects the Kernel's networking subsystem, specifically the dsa (Distributed Switch Architecture) driver for the ar9331 chipset. This driver is responsible for managing the Ethernet switch functionality on devices using the ar9331 chipset. The vulnerability allows an attacker to exploit a flaw in the driver's mdiobus registration process, potentially leading to unauthorized access, information disclosure, or denial of service.
Vulnerability Detail
The vulnerability arises from a missing devres registration for the mdiobus in the dsa driver for the ar9331 chipset. This oversight allows an attacker to manipulate the mdiobus registration, potentially leading to various security issues. By exploiting this vulnerability, an attacker could gain unauthorized access to the network, intercept or modify network traffic, or cause a denial of service by disrupting the proper functioning of the Ethernet switch. The impact and attack plausibility of this vulnerability have not been proven yet, but it is crucial to address it to ensure the security and integrity of the affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually apply the patch provided in the commit (475ce5dcf2d88fd4f3c213a0ac944e3e40702970) to their existing Kernel version. The patch modifies the dsa driver for the ar9331 chipset to ensure the proper registration of the mdiobus under devres. Here is an example of how the patch can be applied:
--- a/drivers/net/dsa/ar9331.c
+++ b/drivers/net/dsa/ar9331.c
@@ -123,6 +123,7 @@ static int ar9331_setup(struct dsa_switch *ds)
struct ar9331_priv *priv = ds->priv;
struct device *dev = ds->dev;
struct device_node *np = dev->of_node;
+ struct mdiobus *mdio;
priv->mii_bus = devm_mdiobus_alloc(dev);
if (!priv->mii_bus)
@@ -130,6 +131,11 @@ static int ar9331_setup(struct dsa_switch *ds)
priv->mii_bus->name = dev_name(dev);
priv->mii_bus->parent = dev;
priv->mii_bus->read = ar9331_mdio_read;
+ priv->mii_bus->write = ar9331_mdio_write;
+ priv->mii_bus->reset = ar9331_mdio_reset;
+
+ mdio = priv->mii_bus;
+ devres_add(dev, mdio);
ret = of_mdiobus_register(priv->mii_bus, np);
if (ret) {
Conclusion
The vulnerability in the Kernel's dsa driver for the ar9331 chipset poses a potential security risk, allowing unauthorized access, information disclosure, or denial of service. It is crucial to update the Linux Kernel to the latest version or apply the provided patch to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that provides core functionality and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the security and stability of the system.
The dsa driver for the ar9331 chipset is responsible for managing the Ethernet switch functionality on devices using the ar9331 chipset. It allows the system to control and configure the Ethernet ports and handle network traffic.
mdiobus registration is the process of registering the management data input/output bus (MDIO bus) in the Kernel's networking subsystem. The MDIO bus is used for communication between the Ethernet switch and the Ethernet PHYs (Physical Layer transceivers). Proper registration ensures the correct functioning and control of the Ethernet switch.
The potential consequences of this vulnerability include unauthorized access to the network, interception or modification of network traffic, and denial of service by disrupting the proper functioning of the Ethernet switch. However, the actual impact and attack plausibility have not been proven yet.
To protect your system from this vulnerability, it is recommended to update the Linux Kernel to version v5.10.101 or later. This update includes a patch that addresses the missing devres registration issue in the dsa driver for the ar9331 chipset.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
