Null Pointer Dereference in net/x25 Package
Summary
GSD-2022-1002492: net/x25: Fix null-ptr-deref caused by x25_disconnect. Affects Kernel versions >= 08560e93a2c1c93eefe166015f2351196fbbc8e1, < dffc859d1d9560da594e4282091781b8d2715f00. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/x25 package is a part of the Linux Kernel ecosystem and is responsible for handling X.25 network protocol connections. X.25 is a widely used protocol suite for packet-switched communication networks. The net/x25 package provides the necessary functionality to establish and manage X.25 connections within the Linux Kernel. However, a vulnerability has been discovered in the package that can lead to a null pointer dereference.
Vulnerability Detail
The vulnerability in the net/x25 package is caused by a null pointer dereference triggered by the x25_disconnect function. This vulnerability can be exploited by an attacker to crash the system or potentially execute arbitrary code. The null pointer dereference occurs when the x25_disconnect function is called without properly checking if the connection pointer is valid. As a result, a null pointer is dereferenced, leading to a system crash or potential code execution.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.9.311 or later. The fix for this vulnerability was implemented in commit dffc859d1d9560da594e4282091781b8d2715f00. Updating to the latest version of the Linux Kernel will ensure that the x25_disconnect function properly checks the validity of the connection pointer before performing any operations.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a temporary workaround can be implemented by modifying the x25_disconnect function to include a validity check for the connection pointer. Here is an example of the modified code:
void x25_disconnect(struct x25_sock *x25)
{
if (x25 && x25->sk)
{
// Existing code for disconnecting
}
}
By adding the if (x25 && x25->sk) check, the function ensures that the connection pointer is valid before proceeding with the disconnect operation.
Conclusion
The null pointer dereference vulnerability in the net/x25 package can be mitigated by updating the Linux Kernel to version v4.9.311 or later. Alternatively, a temporary workaround can be implemented by modifying the x25_disconnect function. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/x25 package is a component of the Linux Kernel that handles X.25 network protocol connections. X.25 is a widely used protocol suite for packet-switched communication networks.
A null pointer dereference occurs when a program attempts to access or manipulate data using a null pointer, which points to no memory location. This can lead to a crash or potential code execution.
The vulnerability in the net/x25 package can lead to a system crash or potential code execution. An attacker can exploit this vulnerability to disrupt the system or gain unauthorized access.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.9.311 or later. This update includes the necessary fix for the null pointer dereference in the net/x25 package.
Yes, a temporary workaround is available by modifying the x25_disconnect function to include a validity check for the connection pointer. Please refer to the 'workaround' section for more details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.