Null Pointer Dereference Bugs in rxrpc Server Key
Summary
GSD-2022-1001756: rxrpc: fix some null-ptr-deref bugs in server_key.c. Affects Kernel versions >= 12da59fcab5a05d01773e7cb413b8b8f3bb4e334, < 432297011caf71dbc95c3365a65adf365e79aff3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rxrpc package is a part of the Linux Kernel ecosystem and is responsible for providing a reliable, connection-oriented network protocol. It is used for communication between client and server processes. The server_key.c file within the rxrpc package handles the management of server keys, which are used for authentication and encryption purposes. However, this file contains null pointer dereference bugs that can lead to potential security vulnerabilities.
Vulnerability Detail
The null pointer dereference bugs in server_key.c can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with kernel privileges. These bugs occur when the code attempts to dereference a null pointer, leading to a crash or undefined behavior. An attacker can trigger these bugs by sending specially crafted network packets to a vulnerable system. The impact of these vulnerabilities can range from system instability to complete compromise of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality by modifying the configuration to prevent the rxrpc module from loading. This can be achieved by adding the following line to the kernel command line: 'modprobe.blacklist=rxrpc'. However, it is important to note that this workaround will disable the functionality provided by the rxrpc package, which may impact certain applications or services that rely on it.
Conclusion
The null pointer dereference bugs in server_key.c of the rxrpc package pose a significant security risk to Linux Kernel-based systems. It is crucial to update the Linux Kernel to version v5.15.33 or later to mitigate these vulnerabilities. Additionally, users can consider the provided workaround to temporarily disable the affected functionality. For further support and guidance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of these vulnerabilities can range from system instability to complete compromise of the affected system. An attacker can exploit these vulnerabilities to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges.
To fix these vulnerabilities, it is recommended to update the Linux Kernel to version v5.15.33 or later. This update includes the necessary patches to address the null pointer dereference bugs in server_key.c.
As a temporary workaround, users can disable the affected functionality by modifying the configuration to prevent the rxrpc module from loading. This can be achieved by adding the following line to the kernel command line: 'modprobe.blacklist=rxrpc'. However, it is important to note that this workaround will disable the functionality provided by the rxrpc package, which may impact certain applications or services that rely on it.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide assistance and guidance on addressing the vulnerabilities in your system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
