Linux Kernel NULL Pointer Dereference Vulnerability in SUNRPC GSS Authentication

A vulnerability in the Linux kernel's SUNRPC GSS authentication mechanism can lead to a NULL pointer dereference. This issue arises when a zero-length GSS token is processed, resulting in an invalid memory reference. The vulnerability is present in the stable versions of the Linux kernel.

Impact

Exploitation of this vulnerability can cause a kernel panic due to a NULL pointer dereference, leading to a denial of service condition.

Reproduction

The vulnerability can be reproduced by sending a zero-length GSS token to a service that uses SUNRPC with GSS authentication. This will cause the 'gss_read_proxy_verf' function to attempt to copy data from the token without checking if the token is valid, leading to a NULL dereference.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been fixed.