netrom: Decrease sock refcount when sock timers expire
Summary
GSD-2021-1001367: netrom: Decrease sock refcount when sock timers expire. Affects Kernel versions >= 2c6b572458a9127e8070df13fa7f115c29ab1d92, < 9619cc7d97c3aa8ed3cfd2b8678b74fb6d6c7950. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netrom package is a component of the Linux Kernel, which is responsible for implementing the NET/ROM protocol. This protocol is used for amateur radio packet radio networks. The netrom package provides functionality for handling network sockets and timers related to the NET/ROM protocol.
Vulnerability Detail
The vulnerability in the netrom package involves a failure to decrease the reference count of a socket (sock) when its timers expire. This can lead to a reference count leak, potentially causing resource exhaustion and denial-of-service attacks. An attacker could exploit this vulnerability by repeatedly triggering the expiration of timers associated with a large number of sockets, leading to the exhaustion of system resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The netrom package in the Linux Kernel is vulnerable to a reference count leak when sock timers expire. This can result in resource exhaustion and denial-of-service attacks. It is recommended to update the Linux Kernel to version v4.19.199 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The netrom package is a component of the Linux Kernel that implements the NET/ROM protocol for amateur radio packet radio networks.
This vulnerability can lead to resource exhaustion and denial-of-service attacks by causing a reference count leak in the netrom package.
An attacker can exploit this vulnerability by triggering the expiration of timers associated with a large number of sockets, leading to resource exhaustion.
To fix this vulnerability, update the Linux Kernel to version v4.19.199 or later, which includes the necessary fix.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
