Remote code execution flaw patched in Linux Kernel TIPC module

A code execution vulnerability has been patched in the TIPC module of the Linux Kernel.

The Transparent Inter Process Communication (TIPC) module has been designed to facilitate intra-cluster communication across Ethernet or UDP connections and is capable of service addressing, tracking, managing communication between nodes, and more. 

This protocol is implemented in a kernel module package with major Linux distros. 

On Thursday, SentinelOne researchers said that CodeQL has been used recently in bug hunting investigations on open source projects. CodeQL is a semantic code analysis engine that allows users to query code “as if it were data,” and it was this tool that allowed the team to find a severe bug in the TIPC module project. 

According to the researchers, a heap overflow vulnerability was uncovered that could be exploited either locally or remotely to gain kernel-level privileges, “allowing an attacker to not just compromise a single service but the entire system itself.”

SentinelOne found a feature introduced in September 2020 as part of the TIPC module roadmap, a new user message type called MSG_CRYPTO, was the source of the issue. 

While the module correctly validates Message and Header sizes against packet lengths received, there is a lack of validation for

Read More: