Null Dereference in parse dev addr in net: ieee802154
Summary
GSD-2021-1000908: net: ieee802154: fix null deref in parse dev addr. Affects Kernel versions < d0f47648b87b6d5f204cb7f3cbce6d36dab85a67. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net: ieee802154 package is a component of the Linux Kernel, which is responsible for handling IEEE 802.15.4 wireless communication protocols. This package provides support for low-power, low-data-rate wireless networks, such as wireless sensor networks. The vulnerability in the parse dev addr function within this package can lead to a null dereference, potentially causing a system crash or other unexpected behavior.
Vulnerability Detail
The vulnerability arises from a null dereference in the parse dev addr function of the net: ieee802154 package. When parsing a device address, the code fails to handle the case where the address pointer is null, leading to a null dereference. An attacker could potentially exploit this vulnerability by providing a specially crafted device address, causing the system to crash or execute arbitrary code. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The net: ieee802154 package in the Linux Kernel is vulnerable to a null dereference in the parse dev addr function. This vulnerability can potentially lead to system crashes or execution of arbitrary code. It is recommended to update the Linux Kernel to version v5.4.127 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net: ieee802154 package is a component of the Linux Kernel that provides support for IEEE 802.15.4 wireless communication protocols, commonly used in low-power, low-data-rate wireless networks.
A null dereference occurs when a program attempts to access or manipulate memory using a null pointer, leading to a crash or unexpected behavior.
The impact of this vulnerability could include system crashes, unexpected behavior, or potential execution of arbitrary code.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
To fix this vulnerability, users should update their Linux Kernel to version v5.4.127 or later by downloading the updated kernel source code from the official Linux Kernel repository and following the instructions for building and installing the kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
