Vulnerability in ath5k: Out-of-Bounds Read in ath5k_eeprom_read_pcal_info_5111
Summary
GSD-2022-1002201: ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111. Affects Kernel versions < c4e2f577271e158d87a916afb4e87415a88ce856. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ath5k package is a Linux kernel module that provides support for Atheros 5xxx series wireless LAN devices. It allows users to connect to wireless networks and communicate wirelessly. The ath5k_eeprom_read_pcal_info_5111 function is responsible for reading power calibration information from the device's EEPROM. This vulnerability affects the ath5k module and can potentially be exploited by an attacker to read beyond the boundaries of an array, leading to information disclosure or a system crash.
Vulnerability Detail
The vulnerability in ath5k, specifically in the ath5k_eeprom_read_pcal_info_5111 function, allows an attacker to perform an out-of-bounds read. By providing crafted input, an attacker can read data beyond the boundaries of an array, potentially exposing sensitive information or causing the system to crash. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.4.189 by commit c4e2f577271e158d87a916afb4e87415a88ce856.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the ath5k package in the Linux Kernel is vulnerable to an out-of-bounds read in the ath5k_eeprom_read_pcal_info_5111 function. This vulnerability can potentially lead to information disclosure or a system crash. It is crucial to update the Linux Kernel to version v5.4.189 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ath5k is a Linux kernel module that provides support for Atheros 5xxx series wireless LAN devices. It allows users to connect to wireless networks and communicate wirelessly.
The impact of this vulnerability can vary depending on the attacker's intentions and the specific system configuration. It could potentially lead to information disclosure or a system crash.
There is no information available regarding exploitation of this vulnerability in the wild.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
You can find more information about the fix for this vulnerability in the Linux Kernel repository. The specific commit that addresses this issue is c4e2f577271e158d87a916afb4e87415a88ce856.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
