Linux Kernel NULL Pointer Dereference Vulnerability in AF_IUCV Socket Option Handling

A vulnerability in the Linux kernel's handling of socket options for AF_IUCV can lead to a NULL pointer dereference, causing a kernel crash. This issue arises in versions of the Linux kernel prior to the patch included in this CVE. The vulnerability is triggered by a race condition between the recvmsg() function and the getsockopt() function when retrieving the SO_MSGSIZE option. The problem occurs because the SO_MSGSIZE handling dereferences a device MTU value that has been invalidated by a prior operation, leading to a NULL pointer dereference and a kernel oops.

Impact

Exploitation of this vulnerability can cause a kernel crash due to a NULL pointer dereference, disrupting system operations and potentially leading to a denial of service.

Reproduction

To reproduce this vulnerability, an AF_IUCV HIPER user can send a message using recvmsg() while simultaneously calling getsockopt() to retrieve the SO_MSGSIZE option. The race condition will cause the SO_MSGSIZE handler to access a NULL pointer, resulting in a kernel crash.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for downloading the patched version can be found in the Linux kernel documentation.