isdn: cpai: check ctr->cnr to avoid array index out of bound
Summary
UVI-2021-1001960: isdn: cpai: check ctr->cnr to avoid array index out of bound. Affects Kernel versions < 9b6b2db77bc3121fe435f1d4b56e34de443bec75. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The isdn package is a part of the Linux Kernel ecosystem. It provides support for Integrated Services Digital Network (ISDN) devices, allowing communication over digital telephone lines. The cpai module within the isdn package is responsible for handling call progress analysis. It analyzes the audio signals during a call to determine the call progress status, such as dial tone, ringing, or busy signal.
Vulnerability Detail
The vulnerability in the isdn: cpai module arises from a lack of proper bounds checking. Specifically, the code fails to check the 'ctr->cnr' value before accessing an array, which can lead to an out-of-bounds memory access. An attacker could exploit this vulnerability by providing malicious input, potentially resulting in a denial-of-service (DoS) condition or arbitrary code execution. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The isdn: cpai vulnerability in the Linux Kernel's isdn package can be mitigated by updating to version v4.14.253 or later. This update ensures proper bounds checking and prevents potential out-of-bounds memory access. For further support or assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The isdn package is a component of the Linux Kernel that provides support for Integrated Services Digital Network (ISDN) devices, enabling communication over digital telephone lines.
The cpai module is responsible for call progress analysis in the isdn package. It analyzes audio signals during a call to determine the call progress status, such as dial tone, ringing, or busy signal.
The impact of this vulnerability is not yet proven. However, it could potentially lead to a denial-of-service (DoS) condition or arbitrary code execution if exploited by an attacker.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.14.253 or later, which includes the necessary fix for the isdn: cpai module.
You can find more information about this vulnerability in the Linux Kernel's Git repository. The specific commit that fixes this vulnerability is 9b6b2db77bc3121fe435f1d4b56e34de443bec75.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
