Null Pointer Dereference in net/x25
Summary
GSD-2022-1001490: net/x25: Fix null-ptr-deref caused by x25_disconnect. Affects Kernel versions >= 4becb7ee5b3d2829ed7b9261a245a77d5b7de902, < 4a279d7ee1c65411b4055ecd428b8aa2b1711c1f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/x25 package is a part of the Linux Kernel ecosystem and is responsible for handling X.25 network protocol connections. X.25 is a widely used protocol suite for packet-switched communication networks. The net/x25 package provides the necessary functionality to establish and manage X.25 connections within the Linux Kernel. However, a vulnerability has been discovered in the package that can lead to a null pointer dereference.
Vulnerability Detail
The vulnerability in net/x25 is caused by a null pointer dereference triggered by the x25_disconnect function. This vulnerability can be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code in the context of the affected system. The null pointer dereference occurs when the x25_disconnect function is called without properly checking if the x25_sock data structure is valid. This can result in a crash or other unexpected behavior.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.16.19 or later. The fix for this vulnerability was implemented in commit 4a279d7ee1c65411b4055ecd428b8aa2b1711c1f. Updating the kernel to the latest version ensures that the x25_disconnect function properly handles null pointers and prevents the vulnerability from being exploited.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a temporary workaround can be implemented by disabling the use of the X.25 network protocol. This can be achieved by removing the 'x25' module or disabling the 'CONFIG_X25' option in the kernel configuration. However, this workaround may impact systems that rely on X.25 for communication.
Conclusion
The null pointer dereference vulnerability in the net/x25 package can lead to a denial-of-service condition or potential execution of arbitrary code. To mitigate this vulnerability, it is crucial to update the Linux Kernel to version v5.16.19 or later. If immediate kernel update is not possible, the workaround of disabling the X.25 network protocol can be implemented. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a denial-of-service condition or potential execution of arbitrary code in the context of the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you in real-time if the vulnerability is present.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the necessary updates to mitigate the risk.
To exploit this vulnerability, an attacker would need the ability to send specially crafted X.25 network protocol packets to the target system.
Yes, you can implement the workaround mentioned in this report to disable the use of the X.25 network protocol. However, it is still recommended to update the kernel as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.