net_sched: NULL dereference in fifo_set_limit()
Summary
GSD-2021-1001493: net_sched: fix NULL deref in fifo_set_limit(). Affects Kernel versions >= fb0305ce1b03f6ff17f84f2c63daccecb45f2805, < 0dd7ddc462b9c2d31eb5a9926a2cc63eaa3e9f52. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net_sched package is a component of the Linux Kernel that provides network traffic control and queuing functionality. It is responsible for managing the scheduling and prioritization of network packets. The fifo_set_limit() function within net_sched is used to set the limit for a First-In-First-Out (FIFO) queue. This vulnerability in fifo_set_limit() can lead to a NULL dereference, potentially resulting in a system crash or other adverse effects.
Vulnerability Detail
The vulnerability originates from a NULL dereference in the fifo_set_limit() function of net_sched. When setting the limit for a FIFO queue, the function fails to handle the case where the queue pointer is NULL. This can be exploited by an attacker to trigger a NULL pointer dereference, leading to a system crash or potential code execution. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The NULL dereference vulnerability in fifo_set_limit() of net_sched can have serious consequences, including system crashes and potential code execution. It is crucial to update the Linux Kernel to version v4.4.289 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
net_sched is a component of the Linux Kernel that provides network traffic control and queuing functionality.
fifo_set_limit() is a function within net_sched that is used to set the limit for a First-In-First-Out (FIFO) queue.
A NULL dereference occurs when a program attempts to access or manipulate memory using a NULL pointer, resulting in a crash or potential code execution.
The vulnerability can lead to a system crash or potential code execution, depending on how it is exploited.
To fix the vulnerability, update your Linux Kernel to version v4.4.289 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
