PT-2018-2843 · Linux · Linux Kernel
Published
2018-12-03
·
Updated
2018-12-03
CVSS v2.0
4.9
Medium
| Vector | AV:L/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to a null pointer dereference in the Linux kernel's implementation of the mpi alloc function in the digsig/digsig verif.ko module. This can lead to a denial of service when the system runs out of memory. The problem arises because the mpi alloc function ignores the error returned by m alloc. If m alloc returns null, for example, due to a memory shortage, a null pointer dereference occurs. Additionally, the return code for mpi alloc is not checked in the keytable init pubkey function, and memory allocated by mpi alloc is not freed in case of an error in read mpi. The digsig init module function also fails to release resources in case of an error in digsig load main key and does not check the return code or release resources for digsig load additional key.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel