CVE-2015-8787: Null Pointer Dereference
Kernel NULL pointer dereference vulnerability was found in netfilter/nfnatredirect.c in nfnatredirectipv4 function introduced by commit 8b13eddfdf04cbfa561725cfc42d6868fe896f56 ("netfilter: refactor NAT redirect IPv4 to use it from nftables").
Vulnerable code:
unsigned int nfnatredirectipv4(struct skbuff skb, ... { ... rcureadlock(); indev = indevgetrcu(skb->dev); if (indev != NULL) { ifa = indev->ifalist; newdst = ifa->ifalocal; <--- } rcureadunlock(); ... }
'ifa' is not checked before access and can be accessed even if it's NULL. Crash might happen when packets that need to be redirected somehow arrive on an interface which hasn't been yet fully configured.
Patch and crash report:
https://lkml.org/lkml/2015/12/2/618
Oss-security reference:
http://seclists.org/oss-sec/2016/q1/223
CVE assignment:
http://seclists.org/oss-sec/2016/q1/226
Other sources
The nfnatredirectipv4 function in net/netfilter/nfnatredirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2015-8787.
What is the severity of CVE-2015-8787?
The severity of CVE-2015-8787 is medium with a severity value of 4.
How does CVE-2015-8787 affect the Linux kernel?
CVE-2015-8787 allows remote attackers to cause a denial of service or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured system, leading to a NULL pointer dereference and system crash.
Which versions of the Linux kernel are affected by CVE-2015-8787?
Versions of the Linux kernel before version 4.4 are affected by CVE-2015-8787.
How do I fix CVE-2015-8787?
To fix CVE-2015-8787, update your Linux kernel to version 4.4 or later.