net_sched: NULL dereference in fifo_set_limit() in Kernel
Summary
GSD-2021-1001505: net_sched: fix NULL deref in fifo_set_limit(). Affects Kernel versions >= fb0305ce1b03f6ff17f84f2c63daccecb45f2805, < 08d7056e8e250fd2e67dbea5be5fdecdd75bf6b4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The net_sched module within the Kernel is responsible for network traffic control and scheduling. It ensures fair distribution of network resources and implements various queuing disciplines. However, a vulnerability has been identified in the fifo_set_limit() function of net_sched, which can lead to a NULL dereference.
Vulnerability Detail
The vulnerability in fifo_set_limit() function of net_sched allows an attacker to trigger a NULL pointer dereference. This can potentially result in a system crash or privilege escalation, leading to unauthorized access or denial of service. The issue was introduced in version v2.6.27 of the Linux Kernel and has been fixed in version v4.9.287. The vulnerability can be exploited by an attacker with local access to the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, implementing strict access controls and limiting local user privileges can help mitigate the risk of exploitation.
Conclusion
The NULL dereference vulnerability in the fifo_set_limit() function of net_sched in the Linux Kernel can have serious consequences, including system crashes and privilege escalation. It is crucial to update the Kernel to the latest version to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a system crash or privilege escalation, potentially enabling unauthorized access or denial of service.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
No, this vulnerability requires local access to the system to be exploited.
There are no known instances of this vulnerability being exploited in the wild.
Yes, the vulnerability has been fixed in version v4.9.287 of the Linux Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
