Read Out-of-Bounds Vulnerability in ubifs
Summary
GSD-2022-1001116: ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock(). Affects Kernel versions >= 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d, < 3b7fb89135a20587d57f8877c02e25003e9edbdf. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ubifs package is a file system designed for use on flash memory devices. It is commonly used in embedded systems and provides features such as wear-leveling and compression. The vulnerability in ubifs_wbuf_write_nolock() allows for a read out-of-bounds issue, which can potentially lead to information disclosure or system crashes.
Vulnerability Detail
The vulnerability arises from a read out-of-bounds issue in the ubifs_wbuf_write_nolock() function. This function is responsible for writing data to the write buffer in the ubifs file system. By exploiting this vulnerability, an attacker could potentially read data beyond the intended boundaries of the buffer, accessing sensitive information or causing the system to crash. The vulnerability was introduced in version v2.6.27 of the Linux Kernel and has been fixed in version v5.17.2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the kernel is not immediately feasible, a possible workaround is to disable the use of the ubifs file system or switch to an alternative file system until the kernel can be updated. This can be done by modifying the system configuration to use a different file system or by mounting a different file system on affected devices.
Conclusion
The read out-of-bounds vulnerability in ubifs can be mitigated by updating the Linux Kernel to version v5.17.2 or later. If immediate updating is not possible, disabling the use of ubifs or switching to an alternative file system can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ubifs is a file system designed for use on flash memory devices. It provides features such as wear-leveling and compression, making it suitable for embedded systems.
The vulnerability allows for a read out-of-bounds issue, which can potentially lead to information disclosure or system crashes.
To fix this vulnerability, update the Linux Kernel to version v5.17.2 or later.
If updating the kernel is not immediately feasible, a possible workaround is to disable the use of the ubifs file system or switch to an alternative file system.
No known exploits for this vulnerability have been reported at this time.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
