Use After Free Vulnerability in ethernet:enic Package
Summary
UVI-2021-1000330: ethernet:enic: Fix a use after free bug in enic_hard_start_xmit. Affects Kernel versions >= fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3, < 7afdd6aba95c8a526038e7abe283eeac3e4320f1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ethernet:enic package is a component of the Linux Kernel ecosystem. It provides support for Cisco VIC Ethernet NICs. The package enables efficient packet transmission and reception for these network interface cards. However, a use after free vulnerability has been identified in the enic_hard_start_xmit function of the ethernet:enic package.
Vulnerability Detail
The use after free vulnerability in enic_hard_start_xmit arises from improper memory management. When certain conditions are met, the function may attempt to access memory that has already been freed. This can lead to unpredictable behavior, including potential crashes, data corruption, or the execution of arbitrary code by an attacker. The vulnerability was introduced in version v4.16 of the Linux Kernel and has been fixed in version v5.10.38.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the use of the enic_hard_start_xmit function in their code until the Linux Kernel is updated to a version that includes the fix. This can be achieved by modifying the code to use alternative functions or approaches for packet transmission and reception.
Conclusion
The use after free vulnerability in the ethernet:enic package's enic_hard_start_xmit function can have serious consequences, including crashes, data corruption, or the execution of arbitrary code. It is crucial to update the Linux Kernel to version v5.10.38 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The use after free vulnerability in enic_hard_start_xmit can lead to crashes, data corruption, or the execution of arbitrary code by an attacker.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you in real-time if the vulnerability is present.
Yes, a workaround is available. Users can avoid using the enic_hard_start_xmit function in their code until the Linux Kernel is updated to a version that includes the fix.
The vulnerability was introduced in version v4.16 of the Linux Kernel. All versions between v4.16 and v5.10.37 (inclusive) are affected.
To update the Linux Kernel, you can follow the official documentation provided by your Linux distribution. This typically involves using package management tools to install the latest kernel version available.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
