Vulnerability in Kernel: net: dsa: felix: don't use devres for mdiobus
Summary
GSD-2022-1000430: net: dsa: felix: don't use devres for mdiobus. Affects Kernel versions >= ac3a68d56651c3dad2c12c7afce065fe15267f44, < 8cda7577a0b4018572f31e0caadfabd305ea2786. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionality for the proper functioning of the system. The specific vulnerability affects the net subsystem, more specifically the dsa (Distributed Switch Architecture) module, and the felix driver. The mdiobus (Management Data Input/Output Bus) component within the felix driver is susceptible to a security flaw.
Vulnerability Detail
The vulnerability arises from the improper use of devres (Device Resource Management) for mdiobus in the felix driver of the dsa module. Devres is a mechanism in the Linux kernel that simplifies resource management for device drivers. However, in this case, its usage introduces a security vulnerability. The impact and attack plausibility of this vulnerability have not been proven yet. Further analysis is required to determine the potential ramifications. The vulnerability was introduced in version v5.9 of the Linux Kernel by commit ac3a68d56651c3dad2c12c7afce065fe15267f44 and has been fixed in version v5.15.24 by commit 8cda7577a0b4018572f31e0caadfabd305ea2786.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel's net subsystem, specifically the dsa module's felix driver, related to the mdiobus component, has been identified. The impact and attack plausibility of this vulnerability are yet to be proven. It is recommended to update the Linux Kernel to version v5.15.24 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is currently unknown as it has not been proven yet. Further analysis is required to determine the potential ramifications.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Yes, a patch has been released to fix this vulnerability. It is recommended to update the Linux Kernel to version v5.15.24 or later.
No specific workaround has been mentioned for this vulnerability. It is recommended to update the Linux Kernel to the latest version.
You can find more information about this vulnerability in the GSD database entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000430.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
