Null Pointer Dereference in net/x25 Package
Summary
GSD-2022-1001171: net/x25: Fix null-ptr-deref caused by x25_disconnect. Affects Kernel versions >= 4becb7ee5b3d2829ed7b9261a245a77d5b7de902, < 671529db75e6be777bb1c76aa07c2bdd2992be6d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/x25 package is a component of the Linux Kernel, which is responsible for handling X.25 network protocol connections. X.25 is a widely used protocol suite for packet-switched networks. The net/x25 package provides the necessary functionality to establish and manage X.25 connections within the Linux Kernel.
Vulnerability Detail
The vulnerability identified in the net/x25 package is a null pointer dereference issue that occurs during the x25_disconnect operation. This vulnerability was introduced in version v5.7 of the Linux Kernel by commit 4becb7ee5b3d2829ed7b9261a245a77d5b7de902 and affects all versions until v5.17.2. An attacker could exploit this vulnerability by sending a specially crafted X.25 disconnect request, leading to a null pointer dereference and potentially causing a system crash or other unexpected behavior.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the X.25 network protocol if it is not required for their system. This can be done by removing the 'x25' module or disabling the X.25 related configuration options from the Kernel configuration. However, it is strongly advised to apply the official fix by updating the Kernel to the latest version.
Conclusion
The null pointer dereference vulnerability in the net/x25 package of the Linux Kernel can be mitigated by updating the Kernel to version v5.17.2 or later. Users can also consider disabling the X.25 network protocol as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/x25 package is a component of the Linux Kernel that handles X.25 network protocol connections.
X.25 is a widely used protocol suite for packet-switched networks.
A null pointer dereference occurs when a program attempts to access or manipulate data using a null pointer, leading to a crash or unexpected behavior.
An attacker can exploit this vulnerability by sending a specially crafted X.25 disconnect request, triggering a null pointer dereference and potentially causing a system crash or other unexpected behavior.
To fix this vulnerability, update the Linux Kernel to version v5.17.2 or later, which includes the necessary fix for the null pointer dereference issue.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
