Null Pointer Dereference in davinci_voicecodec
Summary
GSD-2022-1003326: mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe(). Affects Kernel versions >= b5e29aa880be84c271be8d0726cec4018bfbfd74, < 5289795824b77489803b0802cd9edc13824a2d0b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The davinci_voicecodec is a component of the Linux Kernel that provides support for voice codecs on the Texas Instruments DaVinci platform. It is responsible for managing the voice codec hardware and providing the necessary interfaces for audio processing. The vulnerability in davinci_voicecodec arises from a potential null pointer dereference in the davinci_vc_probe() function.
Vulnerability Detail
The vulnerability occurs when the davinci_vc_probe() function dereferences a potentially null pointer without proper validation. This can lead to a kernel crash or other unpredictable behavior. An attacker may be able to exploit this vulnerability to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. The vulnerability was introduced in Linux Kernel version 5.4 and is fixed in version 5.15.46.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix as soon as possible.
Conclusion
The null pointer dereference vulnerability in davinci_voicecodec can lead to a kernel crash or other unpredictable behavior. It is recommended to update the Linux Kernel to version 5.15.46 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a kernel crash or other unpredictable behavior, potentially allowing an attacker to cause a denial-of-service condition or execute arbitrary code with kernel privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any known vulnerabilities.
At the time of this report, there is no known exploit for this vulnerability. However, it is still recommended to apply the fix as soon as possible to mitigate any potential risks.
In most cases, this vulnerability requires local access to the system. However, if an attacker already has access to the system, they may be able to exploit this vulnerability to escalate their privileges or cause a denial-of-service condition.
The only effective mitigation for this vulnerability is to apply the provided fix by updating the Linux Kernel to version 5.15.46 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
