Use-after-free vulnerability in sc520_wdt module in Linux Kernel
Summary
UVI-2021-1001328: watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff(). Affects Kernel versions < 7c56c5508dc20a6b133bc669fc34327a6711c24c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sc520_wdt module is a watchdog timer driver in the Linux Kernel. It is responsible for monitoring the system and triggering a system reset if necessary. The sc520_wdt module is used on systems with the National Semiconductor SC520 microcontroller. This vulnerability affects the sc520_wdt module and can lead to a use-after-free condition.
Vulnerability Detail
The use-after-free vulnerability in the sc520_wdt module occurs in the wdt_turnoff() function. This function is responsible for turning off the watchdog timer. However, due to improper handling of resources, it is possible for the function to access freed memory, leading to undefined behavior. An attacker may be able to exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the kernel is not immediately feasible, a possible workaround is to disable the sc520_wdt module. This can be achieved by blacklisting the module or removing it from the kernel configuration. However, disabling the watchdog timer may impact system stability and should be done with caution.
Conclusion
The use-after-free vulnerability in the sc520_wdt module of the Linux Kernel can be mitigated by updating the kernel to version v5.4.134 or later. If immediate updating is not possible, disabling the sc520_wdt module can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The sc520_wdt module is a watchdog timer driver in the Linux Kernel. It is used on systems with the National Semiconductor SC520 microcontroller to monitor the system and trigger a system reset if necessary.
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to undefined behavior and can be exploited by attackers to execute arbitrary code or cause a denial-of-service condition.
To fix this vulnerability, update the Linux Kernel to version v5.4.134 or later. This will patch the use-after-free vulnerability in the sc520_wdt module.
If updating the kernel is not immediately feasible, you can disable the sc520_wdt module by blacklisting it or removing it from the kernel configuration. However, this may impact system stability and should be done with caution.
Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause a denial-of-service condition. It is important to patch the vulnerability to prevent potential security breaches or system instability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
