Vulnerability in Kernel package: llc: only change llc->dev when bind() succeeds
Summary
GSD-2022-1002380: llc: only change llc->dev when bind() succeeds. Affects Kernel versions >= d14193111c436fc5de33206c67c7afd45c730099, < c106f9aa6cd8913af9188ad361899ae696b5de37. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system. It provides the core functionality and acts as an interface between the hardware and software layers. The llc module within the Kernel package is responsible for managing the Link Layer Control (LLC) protocol. This protocol is used for communication between devices in a local area network (LAN). The vulnerability in question arises from a flaw in the llc module's handling of bind() operations.
Vulnerability Detail
The llc module in the Kernel package incorrectly changes the llc->dev attribute even when the bind() operation fails. This can lead to unexpected behavior and potential security issues. An attacker could exploit this vulnerability to manipulate network traffic or cause a denial-of-service (DoS) condition. The vulnerability was introduced in version v4.19.237 of the Linux Kernel and has been fixed in version v4.19.237 by commit c106f9aa6cd8913af9188ad361899ae696b5de37.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel package to version v4.19.237 or later. This can be done by fetching the latest version from the official Git repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and applying the necessary patches. Alternatively, users can wait for their Linux distribution to provide an updated package through their package manager.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The llc module in the Kernel package has a vulnerability that allows for unexpected behavior and potential security risks. It is crucial to update the Linux Kernel package to the fixed version v4.19.237 or later to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially be exploited by attackers to manipulate network traffic or cause a denial-of-service (DoS) condition.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it in real-time.
As of now, there is no known exploit for this vulnerability. However, it is important to apply the recommended fix to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over a network.
There are no reported incidents related to this vulnerability at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.