CVE-2022-1671: Null Pointer Dereference
A NULL pointer dereference flaw was found in rxrpcpreparses in net/rxrpc/serverkey.c in the Linux kernel. This flaw allows a local attacker to crash the system or leak internal kernel information.
Other sources
There are some null-ptr-deref bugs in serverkey.c in net/rxrpc/serverkey.c in the latest kernel, unprivileged users can easily trigger it via ioctl.
#Root Cause Some function calls are not implemented in rxrpcnosecurity, there are preparseserverkey, freepreparseserverkey and destroyserverkey.
When rxrpc security type is rxrpcnosecurity, unprivileged users can easily trigger a null-ptr-deref bug via ioctl. So judgment should be added to prevent it
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1671?
CVE-2022-1671 is classified as a high severity vulnerability due to its potential to allow local attackers to crash the system or leak sensitive kernel information.
How do I fix CVE-2022-1671?
To fix CVE-2022-1671, you should upgrade your Linux kernel to version 5.18 or apply available patches that address this flaw.
Which Linux kernel versions are affected by CVE-2022-1671?
CVE-2022-1671 affects Linux kernel versions from 5.11 up to and including 5.18.
Can remote attackers exploit CVE-2022-1671?
No, CVE-2022-1671 is a local privilege escalation vulnerability, meaning it can only be exploited by local attackers with access to the system.
What kind of impact can CVE-2022-1671 have on my system?
CVE-2022-1671 can lead to a system crash or unauthorized access to internal kernel data, compromising system stability and security.