Vulnerability in Kernel: net: dsa: bcm_sf2: don't use devres for mdiobus
Summary
GSD-2022-1000370: net: dsa: bcm_sf2: don't use devres for mdiobus. Affects Kernel versions >= ac3a68d56651c3dad2c12c7afce065fe15267f44, < 2770b795294ed312375c11ef1d0b810499c66b83. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services to enable the proper functioning of the system. The specific vulnerability affects the bcm_sf2 driver in the Kernel, which is responsible for managing the Broadcom SF2 Ethernet switch. This driver utilizes the devres mechanism for managing resources, including the mdiobus (MDIO bus) used for communication with Ethernet PHYs. However, this approach introduces a security vulnerability that could potentially be exploited.
Vulnerability Detail
The vulnerability arises from the improper use of devres for mdiobus in the bcm_sf2 driver. By leveraging this vulnerability, an attacker could potentially gain unauthorized access or execute arbitrary code on the system. The exact impact and attack vectors have not been proven yet, but it is crucial to address this vulnerability to ensure the security and integrity of the system. The vulnerability was introduced in Kernel version v5.9 by commit ac3a68d56651c3dad2c12c7afce065fe15267f44 and has been fixed in version v5.10.101 by commit 2770b795294ed312375c11ef1d0b810499c66b83.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel's bcm_sf2 driver poses a potential security risk that could lead to unauthorized access or arbitrary code execution. It is crucial to update the Kernel to version v5.10.101 or later to mitigate this vulnerability. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially allow an attacker to gain unauthorized access or execute arbitrary code on the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
Yes, a patch is available in Kernel version v5.10.101. It is recommended to update to this version or later to fix the vulnerability.
Updating the Kernel is the recommended approach to mitigate the risk. However, if updating is not feasible, you can consider implementing additional security measures, such as network segmentation and access control, to reduce the potential impact of the vulnerability.
You can find more information about this vulnerability in the GSD database entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000370.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
