NULL pointer dereference in virtio_gpu_conn_get_modes
Summary
GSD-2022-1003414: drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes. Affects Kernel versions < 32e10aabc287f09a148ff759bb9ce70b01b0012c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. The virtio_gpu_conn_get_modes function in the drm/virtio module is vulnerable to a NULL pointer dereference. This vulnerability can be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code.
Vulnerability Detail
The NULL pointer dereference vulnerability in virtio_gpu_conn_get_modes arises from improper handling of NULL pointers in the virtio_gpu driver. When the function is called with a NULL pointer as an argument, it fails to check for this condition, leading to a dereference of the NULL pointer. An attacker can exploit this vulnerability by sending a specially crafted request to the affected system, triggering the NULL pointer dereference and potentially causing the system to crash or execute arbitrary code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch or update the Kernel package to the fixed version as soon as possible.
Conclusion
The NULL pointer dereference vulnerability in virtio_gpu_conn_get_modes can be mitigated by updating the Linux Kernel package to version v5.15.46 or later. It is crucial to apply the official patch or update the package to ensure the vulnerability is addressed. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a denial-of-service condition or potential execution of arbitrary code, depending on how it is exploited.
An attacker can exploit this vulnerability by sending a specially crafted request to the affected system, triggering the NULL pointer dereference and potentially causing the system to crash or execute arbitrary code.
No, there is no known workaround for this vulnerability. It is recommended to apply the official patch or update the Kernel package to the fixed version.
The vulnerability is fixed in version v5.15.46 of the Linux Kernel package.
For more details about this vulnerability, you can refer to the source link provided in the database_specific section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
