netrom: Decrease sock refcount when sock timers expire
Summary
GSD-2021-1001437: netrom: Decrease sock refcount when sock timers expire. Affects Kernel versions >= baa9e32336bf6d0d74a7c3486d2a27feaf57cd5f, < a01634bf91f2b6c42583770eb6815fb6d1e251cf. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netrom package is a part of the Linux Kernel ecosystem. It provides support for the NET/ROM protocol, which is a network layer protocol used in amateur packet radio networks. The package includes functionality for handling network sockets and timers. The vulnerability in question arises when sock timers expire without properly decreasing the reference count of the socket. This can lead to a resource leak and potential denial-of-service attacks.
Vulnerability Detail
The vulnerability in netrom arises from a failure to decrease the reference count of a socket when its timers expire. This can result in a resource leak, as the socket's resources are not properly released. An attacker could potentially exploit this vulnerability to exhaust system resources and cause a denial-of-service condition. The vulnerability was introduced in version v4.9.155 of the Linux Kernel and is fixed in version v4.9.277.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The netrom package in the Linux Kernel is vulnerable to a resource leak and potential denial-of-service attacks due to a failure to properly decrease the reference count of sockets when timers expire. It is recommended to update to Linux Kernel version v4.9.277 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a resource leak and potential denial-of-service attacks.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time if the vulnerability is present.
Yes, the vulnerability is fixed in Linux Kernel version v4.9.277. It is recommended to update to this version or later to mitigate the vulnerability.
There are no known exploits for this vulnerability at the moment. However, it is still important to apply the fix to prevent potential exploitation.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry with ID GSD-2021-1001437.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
