Use-after-free error during reset in igc package
Summary
UVI-2021-1001316: igc: Fix use-after-free error during reset. Affects Kernel versions >= 13b5b7fd6a4a96dffe604f25e7b64cfbd9520924, < a9508e0edfe369ac95d0825bcdca976436ce780f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The igc package is a component of the Linux Kernel ecosystem. It provides support for Intel Graphics Compiler (IGC) and is responsible for compiling shaders for Intel GPUs. The package is widely used in Linux-based systems that utilize Intel GPUs. However, a vulnerability has been discovered in the package that can lead to a use-after-free error during reset.
Vulnerability Detail
The use-after-free error occurs when a program attempts to access memory that has already been freed. In the case of the igc package, this vulnerability can be triggered during a reset operation. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability was introduced in version v4.20 of the Linux Kernel and has been fixed in version v5.4.136.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The use-after-free error during reset vulnerability in the igc package of the Linux Kernel can pose a significant security risk. It is crucial to update the Linux Kernel to the patched version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the tool will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the recommended patch to mitigate the risk.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over a network.
If updating the Linux Kernel is not immediately feasible, it is recommended to implement other security measures such as network segmentation, access controls, and intrusion detection systems to minimize the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
