tipc: Improve Size Validations for Received Domain Records
Summary
GSD-2022-1000597: tipc: improve size validations for received domain records. Affects Kernel versions >= 35c55c9877f8de0ab129fa1a309271d0ecc868b9, < 1f1788616157b0222b0c2153828b475d95e374a7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is an essential component of the Linux operating system. It provides the core functionality and interfaces for communication between hardware and software components. The TIPC (Transparent Inter-Process Communication) protocol is a part of the Kernel package and is used for communication between processes in a distributed system. TIPC allows processes to exchange messages and data across different nodes in the network.
Vulnerability Detail
The vulnerability identified in the TIPC protocol affects the size validations for received domain records. This vulnerability was introduced in version v4.8 of the Linux Kernel and was fixed in version v5.15.23. The issue arises due to inadequate size checks on received domain records, which could potentially lead to buffer overflows or other memory-related vulnerabilities. An attacker could exploit this vulnerability to execute arbitrary code, escalate privileges, or cause a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in the fix commit (1f1788616157b0222b0c2153828b475d95e374a7) manually. The patch modifies the size validation logic for received domain records, ensuring proper checks to prevent buffer overflows and memory vulnerabilities. Here is an example of the patch code:
- if (record->hdr.hdr_sz < sizeof(*record))
+ if (record->hdr.hdr_sz < sizeof(struct tipc_domain_record))
return -EINVAL;
Conclusion
In conclusion, the TIPC protocol in the Kernel package was found to have a vulnerability related to size validations for received domain records. This vulnerability could lead to buffer overflows, memory vulnerabilities, and potential code execution, privilege escalation, or denial-of-service attacks. It is recommended to update the Linux Kernel package to version v5.15.23 or later to fix this vulnerability. Users can also apply the provided patch as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could allow an attacker to execute arbitrary code, escalate privileges, or cause a denial-of-service condition on a system running an affected version of the Linux Kernel.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a workaround is available. Users can manually apply the provided patch to modify the size validation logic for received domain records. However, it is recommended to update to the fixed version of the Linux Kernel for a more comprehensive solution.
You can obtain the updated Linux Kernel package from the official Linux Kernel repository or through your Linux distribution's package management system. Make sure to update to version v5.15.23 or later to ensure the vulnerability is fixed.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the necessary updates or workarounds to mitigate the risk of potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
