Vulnerability in Kernel: s390/pci: fix zpci_zdev_put() on reserve
Summary
UVI-2021-1002118: s390/pci: fix zpci_zdev_put() on reserve. Affects Kernel versions >= 2a671f77ee49f3e78997b77fdee139467ff6a598, < 4e5d794a2743f5a1e13ee1066ce37711f2696044. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionalities and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the security and stability of the system. The s390/pci module within the Kernel is responsible for handling PCI devices on IBM System z architectures. It provides functions for device initialization, configuration, and management. However, a vulnerability has been identified in the zpci_zdev_put() function when reserving devices, potentially leading to security issues.
Vulnerability Detail
The vulnerability in the s390/pci module arises from an issue in the zpci_zdev_put() function. When reserving devices, the function fails to properly handle certain scenarios, which can result in security vulnerabilities. Although the exact impact and attack vectors have not been proven, it is crucial to address this vulnerability to prevent potential exploitation. The vulnerability was introduced in version v5.14 of the Linux Kernel by commit 2a671f77ee49f3e78997b77fdee139467ff6a598 and has been fixed in version v5.14.15 by commit 4e5d794a2743f5a1e13ee1066ce37711f2696044.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the s390/pci module of the Kernel can potentially lead to security issues. It is crucial to update the Linux Kernel to version v5.14.15 or later to mitigate this vulnerability. By doing so, the fix provided in commit 4e5d794a2743f5a1e13ee1066ce37711f2696044 will be applied, ensuring the proper handling of device reservation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The s390/pci module is a component of the Linux Kernel that deals with PCI devices on IBM System z architectures. It provides functions for device initialization, configuration, and management.
The exact impact of this vulnerability is not yet proven. However, if exploited, it could potentially lead to security issues on systems utilizing the affected Kernel version.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
No specific workaround has been provided for this vulnerability. It is recommended to update the Linux Kernel to the fixed version as soon as possible.
You can find more information about this vulnerability, including the specific commits that introduced and fixed it, in the vulnerability database maintained by the Cloud Security Alliance. The source link is available at: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1002xxx/UVI-2021-1002118.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
