net_sched: NULL dereference in fifo_set_limit() in Kernel
Summary
UVI-2021-1001581: net_sched: fix NULL deref in fifo_set_limit(). Affects Kernel versions >= fb0305ce1b03f6ff17f84f2c63daccecb45f2805, < c951a3be5e8803e93bb49a0aca0d30457d3c1b67. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system that provides core functionalities and interfaces between hardware and software. It manages system resources, facilitates communication between processes, and handles device drivers. The net_sched module within the Kernel is responsible for network packet scheduling and traffic control. It ensures fair distribution of network resources and implements various queuing disciplines. However, a vulnerability has been identified in the fifo_set_limit() function of net_sched, which can lead to a NULL dereference.
Vulnerability Detail
The vulnerability in fifo_set_limit() arises due to a NULL pointer dereference. When certain conditions are met, an attacker can trigger this vulnerability by sending specially crafted network packets, causing the function to dereference a NULL pointer. This can result in a kernel panic or system crash, leading to a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The NULL dereference vulnerability in fifo_set_limit() of the net_sched module in the Linux Kernel can be mitigated by updating to version v5.4.153 or later. This update ensures that the vulnerable code is replaced with the patched version, eliminating the risk of a kernel panic or system crash. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a kernel panic or system crash, resulting in a denial-of-service (DoS) condition.
An attacker can exploit this vulnerability by sending specially crafted network packets that trigger the NULL dereference in fifo_set_limit().
No evidence of active exploits has been reported at this time.
The vulnerability was introduced in version v2.6.27 of the Linux Kernel and persists until version v5.4.152.
Yes, a patch is available in Linux Kernel version v5.4.153, which fixes the NULL dereference in fifo_set_limit().
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
