CVE-2011-4081: Null Pointer Dereference
crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by triggering a failed or missing ghashsetkey function call, followed by a (1) ghashupdate function call or (2) ghashfinal function call, as demonstrated by a write operation on an AFALG socket.
Other sources
The ghashupdate function passes a pointer to gf128mul4klle which will be NULL if ghashsetkey is not called or if the most recent call to ghashsetkey failed to allocate memory. This causes an oops. Fix this up by returning an error code in the null case.
This is trivially triggered from unprivileged userspace through the AFALG interface by simply writing to the socket without setting a key.
The ghashfinal function has a similar issue, but triggering it requires a memory allocation failure in ghashsetkey after at least one successful call to ghashupdate.
Acknowledgements:
Red Hat would like to thank Nick Bowler for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4081?
CVE-2011-4081 has a severity rating that indicates it can cause a denial of service due to a NULL pointer dereference.
How do I fix CVE-2011-4081?
To fix CVE-2011-4081, update the Linux kernel to version 3.1 or higher.
Who is affected by CVE-2011-4081?
CVE-2011-4081 affects local users of the Linux kernel versions prior to 3.1.
What is the impact of CVE-2011-4081?
The impact of CVE-2011-4081 includes potential denial of service and runtime errors due to ghash_setkey function calls.
What versions of the Linux kernel are vulnerable to CVE-2011-4081?
All versions of the Linux kernel prior to 3.1 are vulnerable to CVE-2011-4081.