Vulnerability in Kernel package: mmc: core: use sysfs_emit() instead of sprintf()
Summary
GSD-2022-1001597: mmc: core: use sysfs_emit() instead of sprintf(). Affects Kernel versions < 659ca56b5415c7a1d05e185c36fad80ba165d063. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionalities. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The mmc (MultiMediaCard) subsystem within the Kernel package handles the management of MMC/SD/SDIO cards, enabling data transfer and storage capabilities. However, a vulnerability has been identified in the mmc core, specifically in the usage of the sprintf() function instead of sysfs_emit().
Vulnerability Detail
The vulnerability arises from the use of sprintf() instead of sysfs_emit() in the mmc core code. This can potentially lead to buffer overflows and other memory-related issues. An attacker could exploit this vulnerability to execute arbitrary code, escalate privileges, or cause a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.16.19 by commit 659ca56b5415c7a1d05e185c36fad80ba165d063.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Kernel package to version v5.16.19 or later. This can be done by pulling the latest updates from the official Linux Kernel repository using the following command:
$ git clone https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
Once the updated version is obtained, the Kernel package can be recompiled and installed on the affected system.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can manually modify the affected code in the mmc core to replace the usage of sprintf() with sysfs_emit(). Here is an example of the code modification:
Before:
sprintf(buffer, format, data);
After:
sysfs_emit(buffer, format, data);
Conclusion
In conclusion, a vulnerability has been identified in the Kernel package's mmc core, which could potentially allow attackers to execute arbitrary code, escalate privileges, or cause a denial-of-service (DoS) condition. It is crucial to update the Kernel package to version v5.16.19 or later to mitigate this vulnerability. Alternatively, developers can apply the provided workaround by modifying the affected code. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially allow an attacker to execute arbitrary code, escalate privileges, or cause a denial-of-service (DoS) condition.
There is no evidence of this vulnerability being exploited in the wild at the moment.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, developers can manually modify the affected code in the mmc core to replace the usage of sprintf() with sysfs_emit(). Please refer to the 'workaround' section for more details.
You can find more information about the fix for this vulnerability in the Linux Kernel repository. The specific commit that addresses this vulnerability is 659ca56b5415c7a1d05e185c36fad80ba165d063.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.