net: hso: fix NULL-deref on disconnect regression in Kernel
Summary
UVI-2021-1000186: net: hso: fix NULL-deref on disconnect regression. Affects Kernel versions >= 4a2933c88399c0ebc738db39bbce3ae89786d723, < d7fad2ce15bdbbd0fec3ebe999fd7cab2267f53e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that manages the system's resources and facilitates communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The hso module in the Kernel is responsible for supporting High-Speed Option (HSO) devices, which are used for mobile broadband connections. However, a vulnerability has been identified in the hso module that can lead to a NULL-dereference on disconnect, causing a system crash or potential privilege escalation.
Vulnerability Detail
The vulnerability in the hso module of the Kernel arises from a NULL-dereference issue during the disconnection process. When a hso device is disconnected, a specific code path can trigger a NULL pointer dereference, resulting in a system crash or potential privilege escalation. An attacker with local access to the system or a maliciously crafted USB device could exploit this vulnerability to crash the system or gain elevated privileges. The vulnerability was introduced in Kernel version v5.4.112 and has been fixed in version v5.4.115.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The hso module in the Kernel is vulnerable to a NULL-dereference issue on disconnect, which can result in a system crash or potential privilege escalation. Users are advised to update their Kernel to version v5.4.115 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a system crash or potential privilege escalation, allowing an attacker to disrupt the system's operation or gain elevated privileges.
Users running Linux systems with the affected Kernel version (v5.4.112) and utilizing hso devices for mobile broadband connections are potentially affected.
No, this vulnerability requires local access to the system or a maliciously crafted USB device to exploit.
Yes, the vulnerability has been fixed in Kernel version v5.4.115 by commit d7fad2ce15bdbbd0fec3ebe999fd7cab2267f53e.
No, updating to the fixed Kernel version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
