Vulnerability in mxser package: xmit_buf leak in activate when LSR == 0xff
Summary
GSD-2022-1002348: mxser: fix xmit_buf leak in activate when LSR == 0xff. Affects Kernel versions >= 6769140d304731f0a3b177470a2adb4bacd9036b, < 685b6d16bf89595310b5d61394c9b97cc9505c7c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mxser package is a part of the Linux Kernel ecosystem. It provides support for the MOXA Smartio/Industio family of multiport serial cards. These cards are commonly used in industrial applications to enable communication with various devices. The mxser package handles the activation and transmission of data through these serial cards.
Vulnerability Detail
The vulnerability in the mxser package occurs when the Line Status Register (LSR) value is set to 0xff during the activation process. This leads to a memory leak in the xmit_buf, which can result in resource exhaustion and potential denial-of-service attacks. An attacker could exploit this vulnerability by repeatedly activating the mxser device with a specially crafted LSR value, causing the system to run out of memory and become unresponsive.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid setting the LSR value to 0xff during the activation process. This can be achieved by modifying the code that interacts with the mxser package to validate and sanitize the LSR value before activating the device. Here is an example of how the code can be modified:
if (LSR != 0xff) {
// Activate the mxser device
activate(mxser_device);
}
Conclusion
The vulnerability in the mxser package can be mitigated by updating the Linux Kernel to the recommended version. In the meantime, a temporary workaround is available to avoid setting the LSR value to 0xff during activation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The mxser package is a component of the Linux Kernel that provides support for MOXA Smartio/Industio multiport serial cards used in industrial applications.
This vulnerability can lead to resource exhaustion and potential denial-of-service attacks by causing a memory leak in the xmit_buf.
To fix this vulnerability, update the Linux Kernel to version v4.19.238 or later.
Yes, a temporary workaround is to avoid setting the LSR value to 0xff during the activation process.
For more details, refer to the vulnerability report at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002348.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
