jffs2: Use-After-Free Vulnerability in jffs2_clear_xattr_subsystem
Summary
GSD-2022-1002453: jffs2: fix use-after-free in jffs2_clear_xattr_subsystem. Affects Kernel versions >= aa98d7cf59b5b0764d3502662053489585faf2fe, < 3bd2454162ec6bbb5503233c804fce6e4b6dcec5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jffs2 package is a component of the Linux Kernel, which is responsible for handling the Journalling Flash File System 2 (JFFS2). JFFS2 is a file system specifically designed for use with flash memory devices. It provides efficient storage and retrieval of data on such devices. The vulnerability in question affects the jffs2_clear_xattr_subsystem function within the package.
Vulnerability Detail
The vulnerability is a use-after-free issue in the jffs2_clear_xattr_subsystem function of the jffs2 package. This vulnerability allows an attacker to exploit a freed memory region, potentially leading to arbitrary code execution or a denial of service. The vulnerability was introduced in version v2.6.18 of the Linux Kernel and is fixed in version v4.14.276. The specific commit that addresses this vulnerability is 3bd2454162ec6bbb5503233c804fce6e4b6dcec5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version.
Conclusion
The use-after-free vulnerability in jffs2_clear_xattr_subsystem poses a potential security risk to systems running the affected versions of the Linux Kernel. It is crucial to update the kernel to version v4.14.276 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The use-after-free vulnerability in jffs2_clear_xattr_subsystem can potentially allow an attacker to execute arbitrary code or cause a denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze and alert you if the vulnerability is present.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is always recommended to apply security updates promptly to mitigate potential risks.
Yes, this vulnerability can be exploited remotely if the affected system is exposed to untrusted network connections.
For more details about this vulnerability, including its technical aspects and the specific commit that fixes it, please refer to the source link provided in the database_specific section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
