Vulnerability in Kernel: net: dsa: felix: don't use devres for mdiobus
Summary
GSD-2022-1000512: net: dsa: felix: don't use devres for mdiobus. Affects Kernel versions >= ac3a68d56651c3dad2c12c7afce065fe15267f44, < 9db6f056efd089e80d81c774c01b639adf30c097. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and ensures the stability and security of the system. The net subsystem within the Kernel handles network-related operations, including network device drivers and protocols. One of the components in the net subsystem is the dsa (Distributed Switch Architecture) module, which enables the support of Ethernet switches. The felix driver is a specific driver within the dsa module that is responsible for managing the Felix Ethernet switch. The mdiobus is a subsystem within the Kernel that handles the management data input/output (MDIO) bus, which is used for communication between Ethernet PHYs and Ethernet switches. This vulnerability specifically affects the felix driver's usage of devres for mdiobus, which can lead to potential security issues.
Vulnerability Detail
The vulnerability arises from the improper use of devres for mdiobus in the felix driver within the dsa module of the Kernel. Devres is a resource management mechanism in the Kernel that automatically releases resources when they are no longer needed. However, in this case, using devres for mdiobus can introduce security vulnerabilities. The exact impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.16.10 by commit 9db6f056efd089e80d81c774c01b639adf30c097. The vulnerability was introduced in version v5.9 by commit ac3a68d56651c3dad2c12c7afce065fe15267f44.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel's felix driver's usage of devres for mdiobus can potentially introduce security issues. It is crucial to update the Linux Kernel to version v5.16.10 or later to fix this vulnerability. Users can also utilize the Vulert Playground (https://vulert.com/scanner) to check if their system is affected by this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The exact impact of this vulnerability is not yet proven. However, it has the potential to introduce security issues in the felix driver within the dsa module of the Kernel.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for open-source vulnerabilities, including this one.
Yes, a patch for this vulnerability is available in Linux Kernel version v5.16.10. It is recommended to update to this version or later to fix the vulnerability.
No specific workaround has been mentioned for this vulnerability. It is recommended to update to the fixed version of the Linux Kernel.
You can refer to the vulnerability details in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000512.json) for more information about this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
