Incomplete Fix in ax25 Package Leads to UAF and NPD Bugs
Summary
GSD-2022-1000451: ax25: improve the incomplete fix to avoid UAF and NPD bugs. Affects Kernel versions < 4c958f0c5714812461da7785393315b35145ac8c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ax25 package is a component of the Linux Kernel, which is responsible for implementing the AX.25 protocol. This protocol is used for packet radio communication between amateur radio operators. The ax25 package provides the necessary functionality for handling AX.25 frames, routing, and network interfaces. It is an integral part of the Linux Kernel and is widely used in amateur radio applications.
Vulnerability Detail
The ax25 package has been found to have an incomplete fix, which can lead to Use-After-Free (UAF) and Null Pointer Dereference (NPD) bugs. These vulnerabilities can be exploited by an attacker to execute arbitrary code or cause a denial of service. The incomplete fix fails to properly handle certain scenarios, allowing an attacker to manipulate memory and trigger these bugs. The impact of these vulnerabilities can vary depending on the specific use case and system configuration.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the Linux Kernel to the fixed version.
Conclusion
The ax25 package in the Linux Kernel has been found to have an incomplete fix, which can lead to Use-After-Free (UAF) and Null Pointer Dereference (NPD) bugs. These vulnerabilities can be mitigated by updating the Linux Kernel to version v5.15.25 or later. It is important to regularly update the Linux Kernel to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The ax25 package is a component of the Linux Kernel that implements the AX.25 protocol for packet radio communication between amateur radio operators.
Use-After-Free (UAF) and Null Pointer Dereference (NPD) bugs are types of software vulnerabilities that can be exploited by attackers to execute arbitrary code or cause a denial of service.
The impact of these vulnerabilities can vary depending on the specific use case and system configuration. They can potentially allow an attacker to execute arbitrary code or cause a denial of service.
To fix the vulnerability, users are advised to update their Linux Kernel to version v5.15.25 or later.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the Linux Kernel to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
