Vulnerability in Linux Kernel: net: bridge: fix vlan tunnel dst null pointer dereference
Summary
GSD-2021-1001006: net: bridge: fix vlan tunnel dst null pointer dereference. Affects Kernel versions >= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd, < fe0448a3fad365a747283a00a1d1ad5e8d6675b7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a critical component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. It includes various subsystems, such as networking, file systems, and device drivers. The net: bridge module is part of the networking subsystem and is responsible for bridging network traffic between different interfaces. This vulnerability specifically affects the vlan tunnel feature of the net: bridge module.
Vulnerability Detail
The vulnerability in the net: bridge module allows for a null pointer dereference when handling vlan tunnel traffic. This can be exploited by an attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code with kernel privileges. The issue originates from a programming error that fails to properly validate the destination (dst) field in certain scenarios. By sending specially crafted network packets, an attacker can trigger this vulnerability and potentially compromise the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No known workarounds are available for this vulnerability.
Conclusion
The vulnerability in the net: bridge module of the Linux Kernel can lead to a denial of service (DoS) condition or potential code execution with kernel privileges. It is crucial to update the Linux Kernel to version v5.10.46 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial of service (DoS) condition or potential code execution with kernel privileges.
By sending specially crafted network packets, an attacker can trigger a null pointer dereference in the net: bridge module, potentially leading to system compromise.
Yes, the vulnerability has been fixed in Linux Kernel version v5.10.46. Users are advised to update their kernel to this version or later.
No, there are no known workarounds for this vulnerability.
For more details about this vulnerability, you can refer to the vulnerability database entry at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001006.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
