Vulnerability in Kernel: Possible Null Pointer Dereference in ebu_nand_probe()
Summary
GSD-2022-1003121: mtd: rawnand: intel: fix possible null-ptr-deref in ebu_nand_probe(). Affects Kernel versions >= 0b1039f016e8a37c779a4aee362cb2100ebb1cfd, < daa5166450b447415aeeaac0199e445bae7bd0f2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionalities and acts as an interface between the hardware and software. It manages system resources, facilitates communication between different software components, and ensures the overall stability and security of the system. The vulnerability in question affects the Kernel's mtd (Memory Technology Devices) subsystem, specifically the rawnand driver for Intel NAND flash devices. This driver is responsible for handling communication with Intel NAND flash memory chips. The vulnerability arises in the ebu_nand_probe() function, which is used to initialize and probe Intel EBU (Enhanced Bootloader Utility) NAND flash devices.
Vulnerability Detail
The vulnerability is a possible null pointer dereference in the ebu_nand_probe() function of the rawnand driver for Intel NAND flash devices. A null pointer dereference occurs when a program attempts to access or dereference a memory address that is null (i.e., does not point to any valid memory location). In this case, the vulnerability can be triggered if the ebu_nand_probe() function is called with a null pointer as one of its arguments. This could lead to a system crash (kernel panic) or potentially be exploited by an attacker to execute arbitrary code with kernel privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the vulnerability by refraining from using Intel EBU NAND flash devices or by disabling the rawnand driver for Intel NAND flash devices in the Kernel configuration. However, these workarounds may result in the loss of functionality related to Intel EBU NAND flash devices.
Conclusion
In conclusion, the vulnerability in the Kernel's rawnand driver for Intel NAND flash devices could potentially lead to a null pointer dereference, system crashes, or even arbitrary code execution. It is crucial to update the Kernel to the latest version (v5.17.14) to mitigate this vulnerability. Alternatively, users can employ workarounds, such as avoiding the use of Intel EBU NAND flash devices or disabling the rawnand driver, although these may result in the loss of related functionality. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that manages system resources, facilitates communication between software components, and ensures system stability and security.
The mtd (Memory Technology Devices) subsystem is a part of the Linux Kernel responsible for handling various types of flash memory devices, including NAND flash memory.
The rawnand driver is a component of the mtd subsystem that provides support for raw NAND flash memory devices, such as Intel NAND flash chips.
A null pointer dereference occurs when a program attempts to access or dereference a memory address that is null, resulting in a crash or potential security vulnerability.
To update the Kernel, you can obtain the latest source code from the official Git repository and compile it according to the provided instructions.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
