Refcount Leaks in ax25 Package
Summary
GSD-2022-1002073: ax25: Fix refcount leaks caused by ax25_cb_del(). Affects Kernel versions >= 5ea00fc60676c0eebfa8560ec461209d638bca9d, < b20a5ab0f5fb175750c6bafd4cf12daccf00c738. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ax25 package is a part of the Linux Kernel ecosystem and is responsible for implementing the AX.25 protocol, which is used for packet radio communication. This protocol enables communication between amateur radio operators and is commonly used in various applications. The ax25 package provides the necessary functionality for handling AX.25 frames and managing AX.25 connections.
Vulnerability Detail
The vulnerability in the ax25 package is related to refcount leaks caused by the ax25_cb_del() function. This function is responsible for deleting an AX.25 control block (CB) and releasing associated resources. However, due to a coding error, the function fails to properly handle reference counting, leading to refcount leaks. This can result in memory leaks and potential resource exhaustion, which may be exploited by an attacker to cause a denial-of-service (DoS) condition or other adverse effects.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a possible workaround is to disable the ax25 package or remove it from the system if it is not required. This can be achieved by modifying the Kernel configuration or removing the relevant modules. However, this workaround may impact applications or systems that rely on the ax25 functionality.
Conclusion
The ax25 package in the Linux Kernel is vulnerable to refcount leaks caused by the ax25_cb_del() function. This vulnerability can lead to memory leaks and potential resource exhaustion, which may be exploited by an attacker. It is crucial to update the Kernel to the recommended version or apply the provided workaround to mitigate the risk. For further assistance or information, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The ax25 package is a part of the Linux Kernel ecosystem and implements the AX.25 protocol for packet radio communication.
The vulnerability can result in refcount leaks, leading to memory leaks and potential resource exhaustion. This may be exploited by an attacker to cause a denial-of-service (DoS) condition or other adverse effects.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.112 or later, which includes the necessary patch to address the refcount leaks.
If updating the Kernel is not immediately feasible, a possible workaround is to disable or remove the ax25 package from the system. However, this may impact applications or systems that rely on the ax25 functionality.
For more information about this vulnerability, you can refer to the provided references link or contact info@devnack.com for further support.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
