NULL Pointer Check Vulnerability in Kernel
Summary
GSD-2022-1002993: lkdtm/bugs: Check for the NULL pointer after calling kmalloc. Affects Kernel versions >= ae2e1aad3e48e495878d9f149e437a308bfdaefa, < ec89c6200f8d94a86d57b2bb881fb079417f4901. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The vulnerability in focus is related to the 'lkdtm/bugs' module, which is a set of kernel self-tests designed to expose various bugs and vulnerabilities. This specific vulnerability arises due to a missing NULL pointer check after calling the 'kmalloc' function.
Vulnerability Detail
The vulnerability occurs when the 'kmalloc' function is called without checking if the returned pointer is NULL. This can lead to a NULL pointer dereference, causing the system to crash or potentially allowing an attacker to execute arbitrary code. The vulnerability was introduced in version v5.7 of the Linux Kernel and was fixed in version v5.17.15. It is important to note that the impact and attack plausibility of this vulnerability have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can manually add a NULL pointer check after calling the 'kmalloc' function to ensure the returned pointer is not NULL. Here is an example of how this can be done in C code:
void *ptr = kmalloc(size, GFP_KERNEL);
if (ptr == NULL) {
// Handle error or return
}
Conclusion
The NULL pointer check vulnerability in the Kernel, specifically in the 'lkdtm/bugs' module, can lead to system crashes or potential code execution. It is crucial to update the Linux Kernel to version v5.17.15 or later to address this vulnerability. Developers can also implement a workaround by manually adding a NULL pointer check. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from a system crash to potential code execution by an attacker.
You can check the version of the Linux Kernel installed on your system and compare it to the fixed version (v5.17.15 or later). Additionally, you can use vulnerability monitoring tools like Vulert (https://vulert.com) to scan your system for known vulnerabilities.
At the time of this report, no known exploits for this vulnerability have been documented.
The remote exploitability of this vulnerability has not been determined. However, it is always recommended to keep systems up to date to mitigate potential risks.
As mentioned earlier, a workaround is available by manually adding a NULL pointer check after calling the 'kmalloc' function. However, it is strongly advised to update the Kernel to the fixed version to ensure comprehensive vulnerability mitigation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
