Critical NULL Pointer Dereference in Linux Kernel's Virtio GPU Package
Summary
CVE-2021-47657: In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() If virtio_gpu_object_shmem_init() fails (e.g. Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. The virtio GPU is a virtual graphics device that allows efficient graphics processing in virtualized environments. This package is crucial for enabling graphical interfaces in virtual machines, enhancing performance and resource management. However, it is susceptible to vulnerabilities that can compromise system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the virtio GPU subsystem, specifically within the function virtio_gpu_array_put_free(). If the initialization function virtio_gpu_object_shmem_init() fails, it can lead to a NULL pointer being passed to virtio_gpu_array_put_free(). This oversight can result in a system crash or unexpected behavior, as the function does not adequately check for NULL values before proceeding. The vulnerability was reported through syzbot, highlighting the potential for fault injection attacks that exploit this flaw.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2021-47657 represents a significant vulnerability in the Linux kernel's virtio GPU subsystem, with the potential to cause system crashes due to NULL pointer dereferences. Users are advised to update their systems to the patched version 5.17.3-1 to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47657 is a vulnerability in the Linux kernel's virtio GPU subsystem that can lead to a NULL pointer dereference, potentially causing system crashes.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The primary risk is system instability, which can lead to crashes or unexpected behavior in virtualized environments using the virtio GPU.
Yes, a patch has been released in version 5.17.3-1 for both Debian 12 and 13. It is recommended to update your system to this version.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup required.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
