Vulnerability in Kernel Package: Fix kfree() of bootmem memory again
Summary
GSD-2022-1001182: kernel/resource: fix kfree() of bootmem memory again. Affects Kernel versions >= ebff7d8f270d045338d9f4796014f4db429a17f9, < ab86020070999e758ce2e60c4348f20bf7ddba56. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and acts as an interface between the hardware and software layers. The package manages system resources, including memory allocation and deallocation. One of the key features of the Kernel package is the bootmem memory management mechanism, which handles memory allocation during the boot process. However, a vulnerability has been discovered in the way the package frees bootmem memory using the kfree() function.
Vulnerability Detail
The vulnerability arises from a flaw in the kfree() function of the Kernel package. When freeing bootmem memory, the function does not properly handle the deallocation process, leading to potential memory corruption or other security issues. An attacker could potentially exploit this vulnerability to execute arbitrary code, escalate privileges, or cause a denial-of-service condition. The vulnerability was introduced in version v3.10 of the Kernel package and has been fixed in version v5.17.2.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Kernel package to version v5.17.2 or later. This can be done by obtaining the latest version from the official Linux Kernel repository and following the installation instructions provided. It is crucial to ensure that the update process is performed correctly to avoid any potential disruptions to the system.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. It is advised to prioritize updating the Kernel package to the fixed version as soon as possible.
Conclusion
The vulnerability in the Kernel package, specifically related to the kfree() function's handling of bootmem memory, poses potential security risks such as arbitrary code execution, privilege escalation, or denial-of-service attacks. It is crucial to update the Kernel package to version v5.17.2 or later to mitigate these risks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow an attacker to execute arbitrary code, escalate privileges, or cause a denial-of-service condition.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and the playground will provide real-time alerts for open-source vulnerabilities, including this one.
At the time of this report, no known exploits for this vulnerability have been disclosed. However, it is important to apply the fix promptly to mitigate any potential risks.
No, only versions from v3.10 to v5.17.1 of the Kernel package are affected. The vulnerability has been fixed in version v5.17.2.
For more details about this vulnerability, you can refer to the source link provided in the database_specific section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.