ax25: Fix NULL pointer dereferences in ax25 timers
Summary
GSD-2022-1001191: ax25: Fix NULL pointer dereferences in ax25 timers. Affects Kernel versions >= 7ec02f5ac8a5be5a3f20611731243dc5e1d9ba10, < a45dba71849a963c427637b3330e2ccf098f42d1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ax25 package is a component of the Linux Kernel, which is responsible for implementing the AX.25 protocol. AX.25 is a data link layer protocol used by amateur radio operators to establish communication between stations. The ax25 package provides the necessary functionality for handling AX.25 connections and managing timers related to these connections.
Vulnerability Detail
The vulnerability in the ax25 package involves NULL pointer dereferences in ax25 timers. This means that under certain conditions, the code may attempt to access memory using a NULL pointer, leading to a crash or potentially exploitable behavior. The vulnerability was introduced in version v5.17 of the Linux Kernel and has been fixed in version v5.17.2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the ax25 package in the Linux Kernel is vulnerable to NULL pointer dereferences in ax25 timers. This vulnerability can potentially lead to crashes, denial of service, or even exploitation. It is recommended to update the Linux Kernel to version v5.17.2 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific conditions and environment. In some cases, it may lead to a crash or denial of service. However, there is also a possibility of potential exploitation, which could result in unauthorized access or other security breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is always recommended to apply security patches and updates as soon as they become available to mitigate any potential risks.
The specific prerequisites for exploiting this vulnerability may vary depending on the context. However, it generally requires the presence of the vulnerable ax25 package in the Linux Kernel and the ability to trigger the conditions that lead to NULL pointer dereferences in ax25 timers.
You can find more information about this vulnerability in the Open Source Vulnerability database maintained by the Cloud Security Alliance. The specific vulnerability ID for this issue is GSD-2022-1001191. You can access the database entry for this vulnerability at the following link: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1001xxx/GSD-2022-1001191.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
