PT-2024-11414 · Linux+2 · Linux Kernel+2
Syzbot
·
Published
2021-09-30
·
Updated
2024-12-31
·
CVE-2021-47418
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.15.0-rc3-syzkaller
Description
A NULL pointer dereference vulnerability was found in the Linux kernel's net sched component, specifically in the
fifo set limit() function. This issue can be triggered by replacing a traffic control discipline with pfifo fast, which does not have a change() operation, and then attempting to change the limit of the replaced discipline. The vulnerability can cause a kernel crash, resulting in a denial-of-service (DoS) condition.Recommendations
To resolve this issue, update the Linux kernel to a version that includes the fix for the
fifo set limit() function. Specifically, versions prior to 5.15.0-rc3-syzkaller are affected, so updating to a newer version will mitigate the vulnerability.As a temporary workaround, consider disabling the
fifo set limit() function until a patch is available. However, this may have unintended consequences on network traffic management and should be carefully evaluated before implementation.At the moment, there is no information about other workarounds or configuration changes that can mitigate this vulnerability without updating the kernel.
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Suse