Vulnerability in Kernel: efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock()
Summary
UVI-2021-1001864: efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock(). Affects Kernel versions < 3b42751401424a1c0f39297b7f4317598aa33474. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and ensures the stability and security of the system. The efi module within the Kernel is responsible for handling the Extensible Firmware Interface (EFI), which is used during system boot to initialize hardware and load the operating system. The virt_efi_reset_system() function in the efi module is used to reset the system. However, it contains a vulnerability that can be exploited by an attacker.
Vulnerability Detail
The vulnerability in the virt_efi_reset_system() function arises from the use of the down_interruptible() function, which can lead to a deadlock situation. This can occur when a process is waiting for a lock to be released, but another process holds the lock indefinitely. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the Kernel's efi module contains a vulnerability in the virt_efi_reset_system() function that can be exploited to cause a DoS condition or execute arbitrary code with elevated privileges. The fix for this vulnerability has been implemented in Linux Kernel version v5.10.75. It is recommended to update to the latest version of the Kernel to mitigate any potential risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could range from a denial-of-service (DoS) condition to the execution of arbitrary code with elevated privileges. However, the actual impact and attack plausibility have not been proven yet.
Yes, this vulnerability has been fixed in Linux Kernel version v5.10.75 by commit 3b42751401424a1c0f39297b7f4317598aa33474.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for open-source vulnerabilities in real-time.
There are currently no known exploits for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
You can find more information about this vulnerability in the Open Source Vulnerability database maintained by the Cloud Security Alliance. The specific vulnerability ID is UVI-2021-1001864.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
