CVE-2011-1478: Null Pointer Dereference
Last updated 24 July 2024
Other sources
The napireuseskb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service (NULL pointer dereference) via a malformed VLAN frame.
There is an issue in the core GRO code where an skb belonging to an unknown VLAN is reused as we don't reset skb->dev in the reuse case. This could result in a NULL pointer dereference.
6d152e23ad1a7a5b40fef1f42e017d66e6115159 gro: reset skbiif on reuse 66c46d741e2e60f0e8b625b80edb0ab820c46d7a gro: Reset dev pointer on reuse
Acknowledgements:
Red Hat would like to thank Ryan Sweat for reporting this issue.
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2011-1478?
CVE-2011-1478 has a moderate severity, as it can lead to denial of service through a NULL pointer dereference.
How do I fix CVE-2011-1478?
To fix CVE-2011-1478, update the Linux kernel to a version later than 2.6.38.
Which Linux kernel versions are affected by CVE-2011-1478?
CVE-2011-1478 affects Linux kernel versions before 2.6.38.
What could be the impact of exploiting CVE-2011-1478?
Exploiting CVE-2011-1478 could result in a denial of service, potentially crashing the system.
Is there a workaround for CVE-2011-1478?
There are no known workarounds for CVE-2011-1478, so upgrading the kernel is the recommended action.