isdn: cpai: check ctr->cnr to avoid array index out of bound
Summary
GSD-2021-1002113: isdn: cpai: check ctr->cnr to avoid array index out of bound. Affects Kernel versions < cc20226e218a2375d50dd9ac14fb4121b43375ff. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The isdn package is a part of the Linux Kernel ecosystem. It provides support for Integrated Services Digital Network (ISDN) devices, allowing communication over digital telephone lines. The cpai component within the isdn package is responsible for handling call progress analysis. It analyzes the audio signals during a call to determine the progress and status of the call. However, a vulnerability has been discovered in the cpai module that can lead to an array index out of bound issue.
Vulnerability Detail
The vulnerability in the isdn cpai module arises due to a lack of proper bounds checking on the 'ctr->cnr' variable. This can result in an array index out of bound error, potentially leading to memory corruption or arbitrary code execution. An attacker could exploit this vulnerability by sending specially crafted input to the affected system, triggering the out of bound access. The impact of this vulnerability can vary depending on the specific use case and system configuration. However, it has the potential to allow an attacker to gain unauthorized access, escalate privileges, or cause a denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the isdn cpai module if it is not required for their system. This can be done by removing or blacklisting the relevant kernel module. However, this workaround may not be feasible for systems that rely on ISDN functionality.
Conclusion
The isdn cpai module in the Linux Kernel is vulnerable to an array index out of bound issue. This can be exploited by an attacker to gain unauthorized access, escalate privileges, or cause a denial of service. It is recommended to update the kernel to version v5.14.15 or later to fix this vulnerability. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The isdn package is a component of the Linux Kernel that provides support for Integrated Services Digital Network (ISDN) devices.
The cpai module is a part of the isdn package and is responsible for call progress analysis, determining the progress and status of a call.
An array index out of bound issue occurs when a program tries to access an element of an array beyond its valid range. This can lead to memory corruption or crashes.
The impacts of this vulnerability can vary depending on the system configuration. However, it has the potential to allow unauthorized access, privilege escalation, or denial of service.
To fix this vulnerability, update the Linux Kernel to version v5.14.15 or later, which includes the necessary fix for the isdn cpai module.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
