NULL Pointer Dereference in Linux Kernel Bonding Driver

Executive Summary

This vulnerability exists in the Linux kernel's network bonding driver. Specifically, in the bond_do_ioctl() function, a pointer called slave_dev is obtained using __dev_get_by_name(), which can return NULL if the requested network interface name does not exist.

However, before checking if slave_dev is NULL, the code calls slave_dbg(), which dereferences slave_dev->name unconditionally. If slave_dev is NULL, this causes a NULL pointer dereference, leading to a kernel oops (crash).

This can be triggered by a user with CAP_NET_ADMIN capability issuing bonding ioctl commands with a non-existent slave interface name, potentially causing a local denial-of-service.

The fix involved moving the slave_dbg() call to after the NULL check to prevent dereferencing a NULL pointer.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by a local user with CAP_NET_ADMIN privileges to cause a denial-of-service (DoS) condition by crashing the kernel.

Specifically, by issuing bonding ioctl commands with a non-existent slave interface name, the attacker can trigger a NULL pointer dereference, resulting in a kernel oops and potentially system instability or downtime.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when a bonding ioctl call (such as SIOCBONDENSLAVE or SIOCBONDRELEASE) is made with a non-existent slave interface name, causing a NULL pointer dereference in the Linux kernel bonding driver.

To detect if your system is vulnerable, you can attempt to invoke bonding ioctl commands with invalid or non-existent slave interface names and observe if the kernel crashes or logs oops messages related to bonding or NULL pointer dereferences.

Example commands to test this might include using the 'ip' or 'ifenslave' utilities with invalid interface names, or writing a small program or script that issues bonding ioctl calls with non-existent slave names, but note that these require CAP_NET_ADMIN privileges.

• Check kernel logs (e.g., dmesg) for bonding-related NULL pointer dereference oops messages after such tests.
• Example command to check kernel logs: dmesg | grep -i 'bonding\|NULL pointer'

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation is to update the Linux kernel to a version where this vulnerability is fixed, specifically where the slave_dbg() call is moved after the NULL check in bond_do_ioctl().

Until the kernel is updated, restrict access to the bonding ioctl interface by limiting CAP_NET_ADMIN capability to trusted users only, as exploitation requires this privilege.

Avoid running untrusted code or userspace programs that can issue bonding ioctl calls with arbitrary interface names.

Useful 0 Not Useful 0