Vulnerability in Kernel package: tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH
Summary
GSD-2022-1002010: tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH. Affects Kernel versions < b1b27b0e8d489b40607127e26af70e5571bf9201. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services and interfaces for hardware, software, and user applications. The tcp module within the Kernel package handles network communication using the Transmission Control Protocol (TCP). It manages incoming and outgoing network connections, ensuring reliable data transmission. However, a vulnerability has been discovered in the tcp module that involves acquiring the inet_listen_hashbucket::lock with disabled BH, potentially leading to security issues.
Vulnerability Detail
The vulnerability arises when the inet_listen_hashbucket::lock is acquired with disabled BH in the tcp module. This can result in security vulnerabilities, although the exact impact and attack plausibility have not been proven yet. The vulnerability has been identified and fixed in the Linux Kernel version v5.10.111 by commit b1b27b0e8d489b40607127e26af70e5571bf9201. It is crucial to update to this version or later to mitigate the vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. It is essential to apply the fix by updating the Linux Kernel package to the recommended version.
Conclusion
In conclusion, a vulnerability has been identified in the Kernel package's tcp module, which involves acquiring the inet_listen_hashbucket::lock with disabled BH. To mitigate this vulnerability, it is essential to update the Linux Kernel package to version v5.10.111 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a crucial component of the Linux operating system, responsible for managing core functionality and providing essential services and interfaces.
The tcp module in the Kernel package handles network communication using the Transmission Control Protocol (TCP), ensuring reliable data transmission.
The exact impact of this vulnerability is not yet proven. However, it has the potential to introduce security vulnerabilities in the tcp module.
To fix this vulnerability, update the Linux Kernel package to version v5.10.111 or later, following the official update process provided by your Linux distribution.
No specific workaround has been mentioned for this vulnerability. It is crucial to apply the fix by updating the Linux Kernel package.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
