isdn: cpai: Array Index Out of Bounds in ctr->cnr
Summary
GSD-2021-1002182: isdn: cpai: check ctr->cnr to avoid array index out of bound. Affects Kernel versions < 1f3e2e97c003f80c4b087092b225c8787ff91e4d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The isdn package is a component of the Linux Kernel that provides support for Integrated Services Digital Network (ISDN) devices. ISDN is a set of communication standards for transmitting voice, video, and data over digital telephone lines. The cpai module within the isdn package is responsible for handling call progress analysis. It analyzes the signals on the ISDN line to determine the progress of a call. However, a vulnerability exists in the cpai module that can lead to an array index out of bounds error.
Vulnerability Detail
The vulnerability in the isdn cpai module arises from a lack of proper bounds checking on the ctr->cnr variable. This variable is used as an index to access an array, but there is no validation performed on its value. An attacker could exploit this vulnerability by providing a malicious input that exceeds the bounds of the array, leading to memory corruption or a crash. The impact of this vulnerability could range from denial of service to potential remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, users can apply a workaround by disabling the isdn cpai module. This can be done by blacklisting the module or removing it from the kernel configuration. However, it is important to note that disabling the module will result in the loss of call progress analysis functionality for ISDN devices.
Conclusion
The isdn cpai module in the Linux Kernel is vulnerable to an array index out of bounds error. This vulnerability can be mitigated by updating the Linux Kernel to version v5.15 or later. Alternatively, users can disable the isdn cpai module, but this will result in the loss of call progress analysis functionality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The isdn package is a component of the Linux Kernel that provides support for Integrated Services Digital Network (ISDN) devices. It enables communication over digital telephone lines for voice, video, and data transmission.
The cpai module is a part of the isdn package that handles call progress analysis. It analyzes the signals on the ISDN line to determine the progress of a call.
An array index out of bounds error occurs when a program tries to access an element of an array using an index that is outside the valid range of indices for that array. In this vulnerability, the ctr->cnr variable is used as an index without proper bounds checking, leading to potential memory corruption or crashes.
The impact of this vulnerability could range from denial of service to potential remote code execution. An attacker could exploit the vulnerability to crash the system or execute arbitrary code with elevated privileges.
To fix this vulnerability, users should update their Linux Kernel to version v5.15 or later. This can be done by downloading the latest kernel source code from the official Linux Kernel repository and compiling it according to the provided instructions.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
