iwlwifi: mei: fix potential NULL-ptr deref
Summary
GSD-2022-1002681: iwlwifi: mei: fix potential NULL-ptr deref. Affects Kernel versions >= 2da4366f9e2c44afedec4acad65a99a3c7da1a35, < 5d8d06fd3a02919100b28f927bcb76481ec0a0e3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The iwlwifi package is a Linux kernel module that provides support for Intel Wireless WiFi Link adapters. It allows users to connect to wireless networks and utilize the features of their Intel WiFi adapters. The package relies on the mei driver, which is responsible for managing the communication between the Intel Management Engine (ME) and the host system. The mei driver provides an interface for applications to interact with the ME firmware. However, a vulnerability has been discovered in the iwlwifi package that could lead to a potential NULL-pointer dereference.
Vulnerability Detail
The vulnerability in the iwlwifi package arises from a potential NULL-pointer dereference in the mei driver. This vulnerability could be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with kernel privileges. The issue originates from a flaw in the code that fails to properly handle a NULL pointer, leading to a crash or potential code execution. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected functionality by blacklisting the iwlwifi module. This can be achieved by adding the following line to the /etc/modprobe.d/blacklist.conf file:
blacklist iwlwifi
After adding the line, the system should be rebooted to apply the changes. However, it is important to note that this workaround will disable the functionality provided by the iwlwifi package, which may impact the ability to connect to wireless networks using Intel WiFi adapters.
Conclusion
The iwlwifi package in the Linux Kernel is vulnerable to a potential NULL-pointer dereference in the mei driver. This vulnerability could result in a denial-of-service (DoS) condition or potential code execution. It is crucial to update the Linux Kernel to version v5.18.3 or later to mitigate this issue. Users can obtain the updated kernel from the official Linux Kernel repository. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The iwlwifi package is a Linux kernel module that provides support for Intel Wireless WiFi Link adapters.
The mei driver is responsible for managing the communication between the Intel Management Engine (ME) and the host system.
A NULL-pointer dereference occurs when a program attempts to access or manipulate data using a pointer that points to NULL (a memory address with no assigned value). This can lead to crashes or potential code execution.
The potential consequences of this vulnerability include a denial-of-service (DoS) condition or the execution of arbitrary code with kernel privileges.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.18.3 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
