Open Source Vulnerability in Kernel: audit: don't deref the syscall args when checking the openat2 open_how::flags
Summary
GSD-2022-1000483: audit: don't deref the syscall args when checking the openat2 open_how::flags. Affects Kernel versions >= 1c30e3af8a79260cdba833a719209b01e6b92300, < 310c9ddfdf1f8d3c9834f02175eae79c8b254b6c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to the system, including process management, memory management, device drivers, and file system access. The vulnerability in question affects the Kernel's audit functionality, specifically related to the dereferencing of syscall arguments when checking the openat2 open_how::flags.
Vulnerability Detail
The vulnerability arises from a flaw in the audit mechanism of the Kernel. When processing openat2 system calls, the audit code mistakenly dereferences the syscall arguments while checking the open_how::flags. This can lead to potential security issues, although the exact impact and attack plausibility have not been proven yet. The vulnerability was introduced in Kernel version v5.16 by commit 1c30e3af8a79260cdba833a719209b01e6b92300 and has been fixed in version v5.16.10 by commit 310c9ddfdf1f8d3c9834f02175eae79c8b254b6c.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the audit functionality in the Kernel. However, this may impact system monitoring and security auditing capabilities. To disable the audit, users can modify the Kernel configuration and rebuild it without the audit feature. Here is an example of modifying the configuration file:
# Disable audit
CONFIG_AUDIT=n
After modifying the configuration, users need to rebuild and reinstall the Kernel.
Conclusion
In conclusion, the Kernel's audit functionality is vulnerable to a flaw that allows the dereferencing of syscall arguments when checking the openat2 open_how::flags. This vulnerability can potentially be exploited by attackers. It is crucial to update the Linux Kernel to version v5.16.10 or later to mitigate this issue. Alternatively, users can temporarily disable the audit functionality, but this may impact system monitoring and security auditing capabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The exact impact of this vulnerability is yet to be proven. However, it has the potential to be exploited by attackers to bypass security measures or gain unauthorized access to sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert analyzes the package-lock.json file to identify and alert in real-time for open-source vulnerabilities.
As of now, there is no known exploit for this vulnerability. However, it is crucial to apply the recommended fix or workaround to mitigate any potential risks.
No, the fix for this vulnerability requires updating the Linux Kernel to version v5.16.10 or later. It is recommended to update the entire Kernel to ensure the necessary patch is applied.
Disabling the audit functionality is a temporary workaround. If system monitoring and security auditing capabilities are crucial for your environment, it is recommended to apply the official fix by updating the Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
