Vulnerability in nvme-pci: NULL pointer dereference in nvme_alloc_admin_tags
Summary
GSD-2022-1002780: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags. Affects Kernel versions < 54a4c1e47d1b2585e74920399455bd9abbfb2bd7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The nvme-pci package is a component of the Linux Kernel that provides support for NVMe (Non-Volatile Memory Express) devices connected via PCI. NVMe is a protocol designed for efficient communication between storage devices and the host system. The nvme-pci package handles the administration and management of NVMe devices through the PCIe interface.
Vulnerability Detail
The vulnerability identified in nvme-pci is a NULL pointer dereference in the nvme_alloc_admin_tags function. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition by sending a specially crafted request to the NVMe device. When the nvme_alloc_admin_tags function is called with an invalid or NULL pointer, it can lead to a kernel crash or system instability. The impact of this vulnerability may vary depending on the specific use case and system configuration.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by updating the Linux Kernel as mentioned above.
Conclusion
The vulnerability in nvme-pci, which involves a NULL pointer dereference in the nvme_alloc_admin_tags function, can lead to a denial-of-service condition and system instability. It is crucial to update the Linux Kernel to version v5.18.3 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
nvme-pci is a component of the Linux Kernel that provides support for NVMe devices connected via PCI. It handles the administration and management of NVMe devices through the PCIe interface.
A NULL pointer dereference occurs when a program attempts to access or manipulate data using a pointer that points to a NULL memory address. This can lead to crashes, system instability, or potential security vulnerabilities.
The impact of this vulnerability can vary depending on the specific use case and system configuration. It can potentially lead to a denial-of-service (DoS) condition, causing a kernel crash or system instability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.18.3 or later. This fix is included in commit 54a4c1e47d1b2585e74920399455bd9abbfb2bd7 of the Linux Kernel source code. Users can obtain the updated kernel from the official Linux Kernel repository.
No, there is no known workaround for this vulnerability. It is necessary to apply the fix by updating the Linux Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
