net: dsa: Avoid cross-chip syncing of VLAN filtering
Summary
GSD-2022-1001241: net: dsa: Avoid cross-chip syncing of VLAN filtering. Affects Kernel versions >= d371b7c92d190448f3ccbf082c90bf929285f648, < e1f2a4dd8d433eec393d09273a78a3d3551339cf. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system. It provides the core functionality and acts as an interface between the hardware and software layers. The package includes various modules and drivers that enable the system to communicate with different hardware devices. One of these modules is the net module, which handles network-related operations. The net module includes the dsa (Distributed Switch Architecture) subsystem, which is responsible for managing Ethernet switches. Within the dsa subsystem, there is a feature called VLAN filtering, which allows the system to filter network traffic based on VLAN tags. This feature is used to segregate network traffic and improve network security. However, a vulnerability has been discovered in the dsa subsystem that could lead to cross-chip syncing of VLAN filtering, potentially compromising network isolation and security.
Vulnerability Detail
The vulnerability in the dsa subsystem of the Kernel package allows for cross-chip syncing of VLAN filtering. This means that VLAN filtering rules set on one switch chip can be propagated to other switch chips, even if they are not intended to have the same VLAN configuration. This can result in network traffic being incorrectly filtered or allowed, potentially bypassing network isolation and security measures. The vulnerability was introduced in version v5.2 of the Linux Kernel and has been fixed in version v5.17.2. It is important to note that the impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The net: dsa: Avoid cross-chip syncing of VLAN filtering vulnerability in the Kernel package could potentially compromise network isolation and security. It is recommended to update to version v5.17.2 or later of the Kernel package to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially compromise network isolation and security by allowing incorrect filtering or bypassing of network traffic.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the playground will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch for this vulnerability is available in version v5.17.2 of the Linux Kernel. It is recommended to update to this version or later to fix the vulnerability.
There are no specific temporary measures mentioned for this vulnerability. It is recommended to update to the fixed version of the Kernel package as soon as possible.
You can find more information about this vulnerability in the GSD-2022-1001241.json file in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1001xxx/GSD-2022-1001241.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
