Vulnerability in tipc: check attribute length for bearer name
Summary
GSD-2022-1002967: tipc: check attribute length for bearer name. Affects Kernel versions >= cb30a63384bc91d5da06e1cede1115f666a29271, < 292be63c382ce20673ee61dff1ee9ed4a3dcaae7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tipc package is a part of the Linux Kernel ecosystem. It provides Transparent Inter-Process Communication (TIPC) functionality, allowing processes to communicate with each other across different nodes in a cluster. TIPC uses attributes to define various properties of the communication channels. One such attribute is the bearer name, which identifies the underlying network interface used for communication. However, a vulnerability exists in the handling of bearer names, where the attribute length is not properly checked. This vulnerability was introduced in version v4.17 of the Linux Kernel and has been fixed in version v5.17.15.
Vulnerability Detail
The vulnerability in tipc arises from the lack of proper attribute length checking for bearer names. An attacker could exploit this vulnerability by providing a specially crafted bearer name with a length that exceeds the expected limit. This could lead to buffer overflows or other memory corruption issues, potentially allowing the attacker to execute arbitrary code or crash the system. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the tipc package in the Linux Kernel is vulnerable to a security issue related to the handling of bearer names. This vulnerability can potentially lead to memory corruption and allow attackers to execute arbitrary code or crash the system. It is crucial to update the Linux Kernel to version v5.17.15 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The tipc package is a part of the Linux Kernel ecosystem and provides Transparent Inter-Process Communication (TIPC) functionality.
A bearer name in tipc is an attribute that identifies the underlying network interface used for communication.
The vulnerability in tipc could potentially allow attackers to execute arbitrary code or crash the system by exploiting memory corruption issues.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.17.15 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
