net_sched: NULL dereference vulnerability in fifo_set_limit()
Summary
UVI-2021-1001505: net_sched: fix NULL deref in fifo_set_limit(). Affects Kernel versions >= fb0305ce1b03f6ff17f84f2c63daccecb45f2805, < 08d7056e8e250fd2e67dbea5be5fdecdd75bf6b4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net_sched package is a component of the Linux Kernel that provides network traffic control and queuing mechanisms. It is responsible for managing the scheduling and prioritization of network packets. The fifo_set_limit() function within net_sched is used to set the limit for a First-In-First-Out (FIFO) queue. This vulnerability affects versions of the Linux Kernel starting from v2.6.27 and was fixed in v4.9.287.
Vulnerability Detail
The vulnerability identified in net_sched is a NULL dereference issue in the fifo_set_limit() function. This vulnerability occurs when the function attempts to dereference a NULL pointer, leading to a system crash or potential privilege escalation. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability.
Conclusion
The net_sched package in the Linux Kernel is vulnerable to a NULL dereference issue in the fifo_set_limit() function. This vulnerability can potentially lead to system crashes, denial-of-service conditions, or privilege escalation. It is crucial to update the Linux Kernel to version v4.9.287 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
net_sched is a component of the Linux Kernel that handles network traffic control and queuing mechanisms.
fifo_set_limit() is a function within net_sched that is used to set the limit for a First-In-First-Out (FIFO) queue.
A NULL dereference vulnerability occurs when a program attempts to access or dereference a memory location that is NULL, resulting in a crash or potential security issue.
This vulnerability could lead to a system crash, denial-of-service (DoS) condition, or potential privilege escalation if exploited by an attacker.
To update the Linux Kernel, users can obtain the latest version from the official Linux Kernel repository and follow the installation instructions provided.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
