Null-Pointer Dereference Vulnerability in audit_filter_rules
Summary
GSD-2021-1001818: audit: fix possible null-pointer dereference in audit_filter_rules. Affects Kernel versions >= bf361231c295d92a28ca283ea713f56e93e55796, < d6f451f1f60c58d73038c7c3177066f8f084e2a2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing core system functions and facilitating communication between hardware and software. It provides essential services such as process management, memory management, and device drivers. The audit_filter_rules function within the Kernel is responsible for handling audit filtering rules, which determine the events that are logged by the system's auditing subsystem. This vulnerability affects versions of the Linux Kernel starting from v5.3 and was fixed in v5.4.156.
Vulnerability Detail
The null-pointer dereference vulnerability in audit_filter_rules arises due to a programming error. When certain conditions are met, a null pointer can be dereferenced, leading to a system crash or potential privilege escalation. An attacker could potentially exploit this vulnerability to execute arbitrary code or disrupt system operations. The vulnerability was introduced in version v5.3 of the Linux Kernel and was fixed in v5.4.156 by commit d6f451f1f60c58d73038c7c3177066f8f084e2a2.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.156 or later. This can be done by obtaining the latest version from the official Linux Kernel repository and following the installation instructions provided. It is crucial to regularly update the Kernel to ensure the latest security patches and bug fixes are applied.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a temporary workaround can be implemented by disabling the auditing subsystem. This can be achieved by modifying the system's configuration files or using the appropriate system administration tools. However, it is important to note that disabling auditing may have implications for system monitoring and security.
Conclusion
The null-pointer dereference vulnerability in audit_filter_rules poses a potential risk to the stability and security of systems running affected versions of the Linux Kernel. It is crucial to update the Kernel to the latest version to mitigate this vulnerability. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The null-pointer dereference vulnerability in audit_filter_rules can potentially lead to a system crash or privilege escalation. It may allow an attacker to execute arbitrary code or disrupt system operations.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities, including this one, are found.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to apply the necessary updates and security patches to mitigate the risk.
This vulnerability requires local access to the system to exploit. It cannot be exploited remotely over a network connection.
As a temporary workaround, you can disable the auditing subsystem. However, it is recommended to update the Kernel as soon as possible to ensure the latest security patches are applied.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.