Vulnerability in Kernel: hns3 VLAN List Lock Protection
Summary
GSD-2022-1001168: net: hns3: add vlan list lock to protect vlan list. Affects Kernel versions >= c6075b193462d9a3930fb41f587f94720658752a, < f58af41deeab0f45c9c80adf5f2de489ebbac3dd. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a critical component of the Linux operating system that provides essential functionality and acts as a bridge between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the overall stability and security of the system. The hns3 module within the Kernel is responsible for handling network communication for Huawei Network Interface Cards (NICs). It includes features such as VLAN (Virtual Local Area Network) support, which allows for the segmentation of network traffic. However, a vulnerability has been identified in the hns3 module that could potentially lead to unauthorized access or manipulation of VLAN configurations.
Vulnerability Detail
The vulnerability in the hns3 module arises from a lack of proper locking mechanisms to protect the VLAN list. Without appropriate synchronization, concurrent access to the VLAN list can result in race conditions and inconsistent state, potentially leading to security breaches or system instability. An attacker could exploit this vulnerability to modify or delete VLAN configurations, intercept network traffic, or cause denial-of-service conditions. The vulnerability was introduced in version v5.1 of the Linux Kernel and has been addressed in version v5.17.2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable VLAN functionality in the hns3 module by modifying the relevant configuration files or using command-line tools. However, this may impact network segmentation and other VLAN-dependent features. It is strongly recommended to apply the official fix as soon as possible.
Conclusion
The vulnerability in the hns3 module of the Kernel poses a potential risk to the security and stability of systems utilizing Huawei NICs. It is crucial to update the Linux Kernel to version v5.17.2 or later to mitigate this vulnerability. Users can also utilize the Vulert Playground (https://vulert.com/scanner) to check if their systems are affected and obtain further support for vulnerability remediation.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability in the hns3 module can potentially allow unauthorized access or manipulation of VLAN configurations, leading to security breaches, interception of network traffic, or denial-of-service conditions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any known vulnerabilities, including this one.
At the time of this report, no known exploits for this specific vulnerability have been identified. However, it is crucial to apply the fix promptly to mitigate any potential risks.
While a temporary workaround is available by disabling VLAN functionality in the hns3 module, it is strongly recommended to apply the official fix by updating the Linux Kernel to the latest version. Workarounds may impact network segmentation and other VLAN-dependent features.
You can refer to the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) for detailed information about the fix. The vulnerability is tracked under ID GSD-2022-1001168 in the GSD database maintained by the Cloud Security Alliance (https://github.com/cloudsecurityalliance/gsd-database).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
