Use-after-free vulnerability in dpaa2-eth package
Summary
UVI-2021-1002261: net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove. Affects Kernel versions >= 7472dd9f649958be6a8880ed439233c8414a7b34, < d74ff10ed2d93dc9b67e99a74b36fb9a83273d8a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dpaa2-eth package is a component of the Linux Kernel, specifically designed for Data Path Acceleration Architecture (DPAA) Ethernet devices. It provides the necessary drivers and functionality for these devices to operate efficiently. The package is responsible for managing the DPAA Ethernet interfaces and handling data transmission and reception.
Vulnerability Detail
The use-after-free vulnerability in dpaa2-eth, identified as UVI-2021-1002261, allows an attacker to exploit a freed memory region. This can lead to a variety of security issues, including remote code execution, denial of service, or information disclosure. The vulnerability was introduced in version v4.17 of the Linux Kernel and was fixed in version v5.4.162. The specific vulnerability occurs in the dpaa2_eth_remove function, where a use-after-free condition arises due to improper memory management.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected dpaa2-eth interface if it is not essential for their system's operation. This can be achieved by modifying the network configuration files or using the appropriate command-line tools. However, it is strongly advised to apply the official patch or update the kernel to ensure comprehensive security.
Conclusion
The use-after-free vulnerability in dpaa2-eth poses a significant risk to systems utilizing DPAA Ethernet devices. It is crucial to promptly update the Linux Kernel to version v5.4.162 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
dpaa2-eth is a package in the Linux Kernel that provides drivers and functionality for Data Path Acceleration Architecture (DPAA) Ethernet devices.
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to various security issues.
The use-after-free vulnerability in dpaa2-eth can result in remote code execution, denial of service, or information disclosure, depending on the attacker's capabilities.
To fix this vulnerability, update the Linux Kernel to version v5.4.162 or later, which includes the necessary patch for dpaa2-eth.
Yes, users can disable the affected dpaa2-eth interface if it is not essential for their system's operation. However, it is recommended to apply the official patch or update the kernel for complete security.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
