Vulnerability in Kernel: net: dsa: bcm_sf2: don't use devres for mdiobus
Summary
GSD-2022-1000510: net: dsa: bcm_sf2: don't use devres for mdiobus. Affects Kernel versions >= ac3a68d56651c3dad2c12c7afce065fe15267f44, < 08e1a3554e99a1a5bd2835907381e2383ee85cae. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and handles device drivers. The bcm_sf2 module in the Kernel is responsible for managing the Broadcom SF2 switch family. This vulnerability specifically affects the mdiobus subsystem within the bcm_sf2 module.
Vulnerability Detail
The vulnerability in the bcm_sf2 module arises from the improper use of devres for mdiobus. Devres is a resource management framework in the Linux Kernel that allows automatic cleanup of resources when they are no longer needed. However, in this case, using devres for mdiobus can lead to a security issue. The exact impact and attack vector of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.16.10 by commit 08e1a3554e99a1a5bd2835907381e2383ee85cae. The vulnerability was introduced in version v5.9 by commit ac3a68d56651c3dad2c12c7afce065fe15267f44.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel's bcm_sf2 module related to the improper use of devres for mdiobus has been identified and fixed in Linux Kernel version v5.16.10. It is crucial to update the Kernel to the latest version to ensure the security of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The exact impact of this vulnerability is not yet proven. However, it is important to apply the fix as soon as possible to ensure the security of the system.
The remote exploitability of this vulnerability is not yet determined. However, it is always recommended to keep the Kernel up to date to mitigate potential security risks.
There are no known instances of this vulnerability being exploited at the moment. However, it is crucial to apply the fix to prevent any potential exploitation.
As the impact and attack plausibility of this vulnerability have not been proven, a CVSS score has not been assigned.
For more details about this vulnerability, you can refer to the source link provided in the database_specific section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
