Null Pointer Dereference Bugs in rxrpc: Linux Kernel
Summary
GSD-2022-1001434: rxrpc: fix some null-ptr-deref bugs in server_key.c. Affects Kernel versions >= 12da59fcab5a05d01773e7cb413b8b8f3bb4e334, < c3c415ae0c82da1349d85b8c9b18e6480aa6a230. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that forms the foundation of various Linux distributions. It provides essential functionality for the system, including device drivers, process management, memory management, and file system support. The rxrpc module in the Linux Kernel is responsible for implementing the Reliable Datagram Protocol (RxRPC) and is used for network communication.
The vulnerability in the rxrpc module involves null pointer dereference bugs in the server_key.c file. Null pointer dereference occurs when a program attempts to access or dereference a null pointer, leading to a crash or potential code execution. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code in the context of the kernel.
Vulnerability Detail
The null pointer dereference bugs in server_key.c within the rxrpc module of the Linux Kernel can be triggered under certain conditions. These bugs were introduced in version v5.11 of the Linux Kernel by commit 12da59fcab5a05d01773e7cb413b8b8f3bb4e334 and were fixed in version v5.16.19 by commit c3c415ae0c82da1349d85b8c9b18e6480aa6a230. The bugs can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code in the context of the kernel. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.16.19 or later. This can be done by obtaining the latest version of the kernel source code from the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compiling it according to the provided instructions. Alternatively, users can wait for their Linux distribution to release an updated kernel package that includes the fix.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the rxrpc module by blacklisting it. This can be achieved by adding the following line to the /etc/modprobe.d/blacklist.conf file:
blacklist rxrpc
After adding the line, reboot the system for the changes to take effect. However, it is important to note that this workaround will disable the functionality provided by the rxrpc module, which may impact certain network communication features.
Conclusion
The null pointer dereference bugs in the rxrpc module of the Linux Kernel can lead to a denial-of-service (DoS) condition or potential code execution. It is crucial to update the Linux Kernel to version v5.16.19 or later to fix these vulnerabilities. In the meantime, users can apply the temporary workaround of blacklisting the rxrpc module. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
These bugs can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code in the context of the kernel.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
Yes, a temporary workaround is to disable the rxrpc module by blacklisting it. Please refer to the 'workaround' section for detailed instructions.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.16.19 or later. Please refer to the 'how_to_fix' section for detailed instructions.
At the time of writing, there are no known exploits for these null pointer dereference bugs. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.