Out-of-Bounds Read Vulnerability in net/smc Package
Summary
GSD-2022-1001661: net/smc: use memcpy instead of snprintf to avoid out of bounds read. Affects Kernel versions >= a3db10efcc4cc9c03a6375920179ade75ea2df7a, < 8a4465368964b4fbaf084760c94c7aabf61059fb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/smc package is a component of the Linux Kernel, which is responsible for managing the SMC (System Management Controller) protocol. SMC is a high-performance, low-latency, and secure communication protocol used for interconnecting servers in a data center. The net/smc package provides the necessary functionality to establish and maintain SMC connections between servers. However, a vulnerability has been discovered in this package that can lead to an out-of-bounds read.
Vulnerability Detail
The vulnerability in the net/smc package arises from the use of snprintf instead of memcpy, which can result in an out-of-bounds read. This vulnerability allows an attacker to read data from memory locations beyond the intended boundaries, potentially exposing sensitive information or causing the system to crash. The vulnerability was introduced in version v5.11 of the Linux Kernel and has been fixed in version v5.11 by commit 8a4465368964b4fbaf084760c94c7aabf61059fb.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The net/smc package in the Linux Kernel is vulnerable to an out-of-bounds read issue, which can be fixed by updating to version v5.11 or later. It is important to promptly address this vulnerability to prevent potential data exposure or system crashes. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/smc package is a component of the Linux Kernel that handles the SMC protocol, which is used for interconnecting servers in a data center.
This vulnerability can allow an attacker to read data from memory locations beyond the intended boundaries, potentially exposing sensitive information or causing system crashes.
To fix this vulnerability, update the Linux Kernel to version v5.11 or later.
Yes, this vulnerability has been fixed in version v5.11 of the Linux Kernel.
For more information, refer to the vulnerability details in the Open Source Vulnerability format or the provided references.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
