Null-Pointer Dereference Vulnerability in audit_filter_rules
Summary
GSD-2021-1002045: audit: fix possible null-pointer dereference in audit_filter_rules. Affects Kernel versions >= bf361231c295d92a28ca283ea713f56e93e55796, < 16802fa4c33eb1a8efb23f1e93365190e4047d05. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing system resources and providing an interface between hardware and software. It plays a crucial role in maintaining the stability and security of the system. The audit_filter_rules function within the Kernel is responsible for handling audit filter rules, which are used to specify the events that should be audited. This vulnerability affects versions of the Linux Kernel from v5.3 to v5.10.75, potentially impacting systems running these versions.
Vulnerability Detail
The null-pointer dereference vulnerability in audit_filter_rules arises from a flaw in the code logic. Under certain conditions, a null pointer can be dereferenced, leading to a crash or potential privilege escalation. An attacker may exploit this vulnerability to execute arbitrary code or cause a denial of service. The vulnerability was introduced in version v5.3 of the Linux Kernel and has been fixed in version v5.10.76.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.76 or later. This update includes the necessary patch to address the null-pointer dereference issue in audit_filter_rules. Users can obtain the updated Kernel version from the official Linux Kernel repository.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the auditing functionality by modifying the audit configuration. However, this is not a recommended long-term solution as it may impact system monitoring and security. To disable auditing, users can modify the audit configuration file (/etc/audit/audit.rules) and comment out or remove any rules related to auditing.
Conclusion
The null-pointer dereference vulnerability in audit_filter_rules within the Linux Kernel can have serious security implications. It is crucial to update the Kernel to version v5.10.76 or later to mitigate the risk. Users can obtain the updated version from the official Linux Kernel repository. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service. It may also lead to privilege escalation.
Versions of the Linux Kernel from v5.3 to v5.10.75 are affected by this vulnerability.
Yes, the vulnerability has been fixed in version v5.10.76 of the Linux Kernel.
Users can update the Linux Kernel by obtaining the latest version (v5.10.76 or later) from the official Linux Kernel repository.
A temporary workaround is to disable auditing by modifying the audit configuration. However, this is not recommended as a long-term solution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.