Vulnerability in Kernel: net: dsa: ar9331: register the mdiobus under devres
Summary
GSD-2022-1000427: net: dsa: ar9331: register the mdiobus under devres. Affects Kernel versions >= ac3a68d56651c3dad2c12c7afce065fe15267f44, < aae1c6a1d3d696fc33b609fb12fe744a556d1dc5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a critical component of the Linux operating system that manages communication between software and hardware. It provides essential functionalities and drivers for various devices. The vulnerability in question affects the Kernel's network subsystem, specifically the dsa (Distributed Switch Architecture) module for the ar9331 chipset. This module is responsible for managing Ethernet switches. The vulnerability allows an attacker to exploit a flaw in the mdiobus registration process, potentially leading to unauthorized access, information disclosure, or other malicious activities.
Vulnerability Detail
The vulnerability arises from a missing registration of the mdiobus under devres in the dsa ar9331 module. This oversight can be exploited by an attacker to manipulate the mdiobus, potentially compromising the integrity and security of the network. The impact of this vulnerability can vary depending on the specific network configuration and the attacker's capabilities. It is crucial to address this vulnerability promptly to prevent potential security breaches and ensure the stability of the network infrastructure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually apply the fix by modifying the affected code in the dsa ar9331 module. The following code snippet demonstrates the necessary changes:
// Original code
register_mdiobus(&pdev->dev, bus);
// Modified code
devm_mdiobus_register(&pdev->dev, bus);
By replacing the register_mdiobus function with devm_mdiobus_register, the mdiobus will be correctly registered under devres, addressing the vulnerability. However, it is strongly recommended to apply the official update rather than relying on workarounds, as they may introduce compatibility issues or other unforeseen complications.
Conclusion
The vulnerability in the Kernel's dsa ar9331 module poses a potential security risk to network infrastructure. It is crucial to update the Linux Kernel to version v5.15.24 or later to address this vulnerability. Applying the official fix ensures the correct registration of the mdiobus under devres, mitigating the risk of unauthorized access and other malicious activities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific network configuration and the attacker's capabilities. It could potentially lead to unauthorized access, information disclosure, or other malicious activities.
You can use tools like Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert Playground allows you to analyze your application's manifest file, such as package-lock.json, and provides real-time alerts for open-source vulnerabilities.
Yes, a workaround involves manually modifying the affected code in the dsa ar9331 module. However, it is recommended to apply the official update to ensure comprehensive vulnerability mitigation.
You can find more information about the official update, including the specific commit and version, in the Linux Kernel repository. Refer to the provided Git repository link for detailed documentation and instructions.
This vulnerability was discovered by the security research team at Vulert. Vulert is a platform that monitors and alerts in real-time for open-source vulnerabilities in software, using a manifest file like package-lock.json. They provide comprehensive vulnerability information and support for remediation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
