NULL Pointer Dereference Affecting kernel-rt-devel package, versions <0:4.18.0-553.22.1.rt7.363.el8_10


Severity

Recommended
high

Based on CentOS security rating.

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about NULL Pointer Dereference vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CENTOS8-KERNELRTDEVEL-7513202
  • published17 Jul 2024
  • disclosed12 Jul 2024

Introduced: 12 Jul 2024

CVE-2024-39506  (opens in a new tab)
CWE-476  (opens in a new tab)

How to fix?

Upgrade Centos:8 kernel-rt-devel to version 0:4.18.0-553.22.1.rt7.363.el8_10 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-rt-devel package and not the kernel-rt-devel package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet

In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value, but then it is unconditionally passed to skb_add_rx_frag() which looks strange and could lead to null pointer dereference.

lio_vf_rep_copy_packet() call trace looks like: octeon_droq_process_packets octeon_droq_fast_process_packets octeon_droq_dispatch_pkt octeon_create_recv_info ...search in the dispatch_list... ->disp_fn(rdisp->rinfo, ...) lio_vf_rep_pkt_recv(struct octeon_recv_info *recv_info, ...) In this path there is no code which sets pg_info->page to NULL. So this check looks unneeded and doesn't solve potential problem. But I guess the author had reason to add a check and I have no such card and can't do real test. In addition, the code in the function liquidio_push_packet() in liquidio/lio_core.c does exactly the same.

Based on this, I consider the most acceptable compromise solution to adjust this issue by moving skb_add_rx_frag() into conditional scope.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVSS Scores

version 3.1