Null-Pointer Dereference Vulnerability in audit_filter_rules
Summary
GSD-2021-1002007: audit: fix possible null-pointer dereference in audit_filter_rules. Affects Kernel versions >= bf361231c295d92a28ca283ea713f56e93e55796, < d6f451f1f60c58d73038c7c3177066f8f084e2a2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system that provides the core functionality and interfaces for various hardware and software components. It manages system resources, facilitates communication between hardware and software, and ensures the security and stability of the system. The audit_filter_rules function within the Kernel package is responsible for handling audit filter rules, which are used to define what events should be audited on the system.
Vulnerability Detail
The audit_filter_rules function in the Kernel package is susceptible to a null-pointer dereference vulnerability. This vulnerability can be triggered when a null pointer is dereferenced, leading to a system crash or potential privilege escalation. An attacker could exploit this vulnerability by crafting a malicious audit filter rule that triggers the null-pointer dereference. The impact of this vulnerability could range from a denial of service (system crash) to potential arbitrary code execution with elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the auditing functionality by modifying the audit configuration or temporarily stopping the audit service. However, this workaround should only be considered as a temporary measure until the Kernel package is updated to a patched version.
Conclusion
The null-pointer dereference vulnerability in the audit_filter_rules function of the Kernel package can lead to system crashes or potential privilege escalation. It is crucial to update the Linux Kernel package to version v5.4.156 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from a denial of service (system crash) to potential arbitrary code execution with elevated privileges.
An attacker can exploit this vulnerability by crafting a malicious audit filter rule that triggers the null-pointer dereference, potentially leading to a system crash or privilege escalation.
Yes, this vulnerability has been fixed in Linux Kernel version v5.4.156 by commit d6f451f1f60c58d73038c7c3177066f8f084e2a2.
To protect your system, it is recommended to update the Linux Kernel package to version v5.4.156 or later, which includes the fix for this vulnerability.
Yes, as a temporary workaround, you can disable the auditing functionality by modifying the audit configuration or stopping the audit service.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
