NULL pointer dereference in Linux kernel

1) NULL pointer dereference

EUVDB-ID: #VU91013

Risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2008-7256

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform service disruption.

The vulnerability exists due to NULL pointer dereference within the include/linux/security.h. A local user can perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1b79cd04fab80be61dcd2732e2423aafde9a4c1c
https://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.28/ChangeLog-2.6.28-rc8
https://www.mandriva.com/security/advisories?name=MDVSA-2010:198
https://www.openwall.com/lists/oss-security/2010/05/27/1
https://bugzilla.redhat.com/show_bug.cgi?id=595970
https://exchange.xforce.ibmcloud.com/vulnerabilities/59224

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.