isdn: cpai: check ctr->cnr to avoid array index out of bound
Summary
GSD-2021-1002050: isdn: cpai: check ctr->cnr to avoid array index out of bound. Affects Kernel versions < 7f221ccbee4ec662e2292d490a43ce6c314c4594. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The isdn package is a part of the Linux Kernel ecosystem. It provides support for Integrated Services Digital Network (ISDN) devices, allowing communication over digital telephone lines. The cpai component within the isdn package is responsible for handling call progress analysis. It analyzes the signaling information to determine the progress of a call, such as whether it is ringing or connected. However, a vulnerability exists in the cpai module that can lead to an array index out of bounds error.
Vulnerability Detail
The vulnerability in the cpai module of the isdn package arises due to a lack of proper bounds checking. Specifically, the code fails to check the 'ctr->cnr' value before accessing an array, which can result in accessing memory outside the bounds of the array. An attacker could exploit this vulnerability by crafting a malicious input that triggers the out of bounds access, potentially leading to a crash or arbitrary code execution. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The isdn package in the Linux Kernel is vulnerable to an array index out of bounds error in the cpai module. This vulnerability can potentially lead to crashes or arbitrary code execution. It is crucial to update the Linux Kernel to version v5.10.76 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The isdn package is a component of the Linux Kernel that provides support for Integrated Services Digital Network (ISDN) devices, enabling communication over digital telephone lines.
The cpai module is a part of the isdn package and is responsible for call progress analysis. It analyzes the signaling information to determine the progress of a call, such as whether it is ringing or connected.
An array index out of bounds error occurs when a program tries to access an element of an array using an index that is outside the valid range of indices for that array. In this case, the code fails to check the 'ctr->cnr' value before accessing an array, leading to potential out of bounds access.
The potential consequences of this vulnerability include crashes, denial of service, or even arbitrary code execution. However, the actual impact and attack plausibility have not been proven yet.
To fix this vulnerability, users should update their Linux Kernel to version v5.10.76 or later. Regularly updating the Linux Kernel is recommended to ensure the latest security patches are applied.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
