Null Pointer Dereference in net/x25 Package
Summary
GSD-2022-1001806: net/x25: Fix null-ptr-deref caused by x25_disconnect. Affects Kernel versions >= 4becb7ee5b3d2829ed7b9261a245a77d5b7de902, < 409570a619c1cda2e0fde6018a256b9e3d3ba0ee. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/x25 package is a part of the Linux Kernel ecosystem. It provides support for the X.25 protocol, which is a widely used protocol for packet-switched communication networks. The X.25 protocol is primarily used in older telecommunications systems and is responsible for establishing connections between devices. The net/x25 package in the Linux Kernel implements the necessary functionality for X.25 communication.
However, a vulnerability has been discovered in the net/x25 package that can lead to a null pointer dereference. This vulnerability can be triggered when the x25_disconnect function is called. A null pointer dereference occurs when a program attempts to access or dereference a null pointer, resulting in a crash or potential code execution. This vulnerability can be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code on the affected system.
Vulnerability Detail
The vulnerability in the net/x25 package is caused by a null pointer dereference in the x25_disconnect function. When this function is called, it fails to properly handle a null pointer, leading to a crash or potential code execution. The exact impact and attack vectors of this vulnerability have not been proven yet, but it is considered a security risk.
The vulnerability was introduced in version v5.7 of the Linux Kernel by commit 4becb7ee5b3d2829ed7b9261a245a77d5b7de902. It has been fixed in version v5.15.33 by commit 409570a619c1cda2e0fde6018a256b9e3d3ba0ee.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel to the latest version.
Conclusion
In conclusion, the net/x25 package in the Linux Kernel is vulnerable to a null pointer dereference when the x25_disconnect function is called. This vulnerability can be exploited to cause a denial-of-service condition or potentially execute arbitrary code. It is crucial to update the Linux Kernel to version v5.15.33 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/x25 package is a part of the Linux Kernel ecosystem and provides support for the X.25 protocol.
A null pointer dereference occurs when a program attempts to access or dereference a null pointer, resulting in a crash or potential code execution.
The impact of this vulnerability can range from a denial-of-service condition to potential code execution on the affected system.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.33 or later.
Users can obtain the updated Linux Kernel from the official Linux Kernel repository at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
