Vulnerability in liquidio package: Fix unintented sign extension of a left shift of a u16
Summary
UVI-2021-1000364: liquidio: Fix unintented sign extension of a left shift of a u16. Affects Kernel versions >= 5bc67f587ba7eaa8dd3976bfeff8f2b60718c871, < f9e9df72dc08873fccfc688fe19b85e93655f052. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The liquidio package is a component of the Linux Kernel ecosystem. It provides support for Cavium LiquidIO SmartNIC devices, which are network interface cards that offload network processing tasks from the host CPU. These devices are commonly used in data centers and cloud environments to improve network performance and reduce CPU utilization. The vulnerability in the liquidio package can lead to unintended sign extension of a left shift of a u16 data type.
Vulnerability Detail
The vulnerability in the liquidio package occurs due to an unintended sign extension of a left shift operation on a u16 (unsigned 16-bit integer) data type. This can result in unexpected behavior and potential security issues. The impact and attack plausibility of this vulnerability have not yet been proven. The vulnerability was introduced in version v4.9 of the Linux Kernel by commit 5bc67f587ba7eaa8dd3976bfeff8f2b60718c871 and is fixed in version v5.10.37 by commit f9e9df72dc08873fccfc688fe19b85e93655f052.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The liquidio package in the Linux Kernel is vulnerable to an unintended sign extension of a left shift operation on a u16 data type. To mitigate this vulnerability, it is recommended to update the Kernel to version v5.10.37 or later. No workaround has been provided. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is currently unknown as the attack plausibility has not been proven. However, it is important to apply the fix to prevent any potential security issues.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it in real-time.
The remote exploitability of this vulnerability has not been determined. It is recommended to apply the fix as a precautionary measure.
There are no known instances of this vulnerability being exploited at this time.
You can refer to the vulnerability database entry for UVI-2021-1000364 at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/UVI-2021-1000364.json for more details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
