Use After Free Vulnerability in net:emac/emac-mac
Summary
UVI-2021-1000481: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send. Affects Kernel versions >= b9b17debc69d27cd55e21ee51a5ba7fc50a426cf, < c7f75d11fe72913d2619f97b2334b083cd7bb955. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net:emac/emac-mac package is a component of the Linux Kernel that provides support for Ethernet Media Access Controller (EMAC) devices. EMAC devices are responsible for managing the communication between a computer and an Ethernet network. The emac_mac_tx_buf_send function in the emac-mac module is vulnerable to a use after free issue.
Vulnerability Detail
The use after free vulnerability in emac_mac_tx_buf_send occurs when a network packet is sent using the function after the corresponding buffer has been freed. This can lead to a variety of issues, including crashes, memory corruption, and potential remote code execution. The vulnerability was introduced in version v4.9 of the Linux Kernel and has been fixed in version v4.9.269.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version to mitigate the risk.
Conclusion
The use after free vulnerability in net:emac/emac-mac's emac_mac_tx_buf_send function can lead to crashes, memory corruption, and potential remote code execution. It is crucial to update the Linux Kernel to the fixed version (v4.9.269 or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The use after free vulnerability in emac_mac_tx_buf_send can lead to crashes, memory corruption, and potential remote code execution. It is crucial to update the Linux Kernel to the fixed version to prevent these issues.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known exploits for this vulnerability. However, it is still crucial to update the Linux Kernel to the fixed version to mitigate the risk.
Unfortunately, there are no known temporary measures or workarounds for this vulnerability. It is recommended to update the Linux Kernel as soon as possible to ensure the security of your system.
You can find more information about this vulnerability in the vulnerability database maintained by the Cloud Security Alliance. The specific entry for this vulnerability can be found at: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/UVI-2021-1000481.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
