net: dsa: bcm_sf2: don't use devres for mdiobus
Summary
GSD-2022-1000429: net: dsa: bcm_sf2: don't use devres for mdiobus. Affects Kernel versions >= ac3a68d56651c3dad2c12c7afce065fe15267f44, < caabb5f64f5c32fceed93356bb688ef1ec6c5783. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net: dsa: bcm_sf2 package is a component of the Linux Kernel that provides support for Broadcom SF2 Ethernet switches. It includes drivers and functionality for managing the switch's MDIO bus, which is used for communication with external PHY devices. The MDIO bus is responsible for configuring and monitoring the PHY devices connected to the switch.
Vulnerability Detail
The vulnerability in net: dsa: bcm_sf2 arises from the improper use of devres for mdiobus. Devres is a resource management framework in the Linux Kernel that allows drivers to automatically release resources when they are no longer needed. However, in this case, using devres for mdiobus can lead to a security vulnerability. The specific technical details of the vulnerability have not been disclosed, but it is important to note that the impact and attack plausibility have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The net: dsa: bcm_sf2 package in the Linux Kernel is vulnerable to a security issue related to the improper use of devres for mdiobus. Users should update their Linux Kernel to version v5.15.24 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net: dsa: bcm_sf2 package is a component of the Linux Kernel that provides support for Broadcom SF2 Ethernet switches.
The MDIO bus is a communication bus used for configuring and monitoring PHY devices connected to the Broadcom SF2 Ethernet switch.
Devres is a resource management framework in the Linux Kernel that allows drivers to automatically release resources when they are no longer needed.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Linux Kernel is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
For more information about this vulnerability, you can refer to the vulnerability database entry at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000429.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
