Vulnerability in ibmvnic: Release of napi in __ibmvnic_open()
Summary
GSD-2022-1000514: ibmvnic: don't release napi in __ibmvnic_open(). Affects Kernel versions >= ed651a10875f13135a5f59c1bae4d51b377b3925, < e08cb9056fb2564d1f6bad789bdf79ab09bf2f81. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ibmvnic package is a component of the Linux Kernel ecosystem. It provides support for IBM Virtual NIC (ibmvnic) devices, which are used in IBM Power Systems. The ibmvnic driver allows these devices to communicate with the operating system and enables network connectivity for virtual machines running on IBM Power Systems. This vulnerability affects versions of the Linux Kernel starting from v4.12 and was fixed in v5.16.10.
Vulnerability Detail
The vulnerability in ibmvnic arises from a flaw in the __ibmvnic_open() function. In this function, the napi structure is released prematurely, leading to a use-after-free vulnerability. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability was introduced in the Linux Kernel v4.12 and was fixed in v5.16.10 by commit e08cb9056fb2564d1f6bad789bdf79ab09bf2f81.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by updating the Linux Kernel to a version that includes the necessary patch.
Conclusion
The vulnerability in ibmvnic, which allowed premature release of the napi structure in the __ibmvnic_open() function, has been fixed in the Linux Kernel version v5.16.10. It is crucial to update the Linux Kernel to a version that includes the fix to mitigate the risk of exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ibmvnic is a component of the Linux Kernel that provides support for IBM Virtual NIC (ibmvnic) devices on IBM Power Systems. It enables network connectivity for virtual machines running on these systems.
The vulnerability in ibmvnic could allow an attacker to execute arbitrary code or cause a denial-of-service condition on a system running an affected version of the Linux Kernel.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
No, there is no known workaround for this vulnerability. It is crucial to apply the fix by updating the Linux Kernel to a version that includes the necessary patch.
The fix for this vulnerability can be found in the Linux Kernel version v5.16.10 or later. You can obtain the updated kernel source code from the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compile it for your system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
