Vulnerability in Kernel: Possible Null Pointer Dereference in cadence_nand_dt_probe()
Summary
GSD-2022-1003630: mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe(). Affects Kernel versions >= ec4ba01e894d3165e4d1ccbef782ef5593b708b4, < 81f1ddffdc22ca5789e33b9d4712914e302090c1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages memory, processes, and system resources. The cadence_nand_dt_probe() function is part of the mtd (Memory Technology Devices) subsystem in the Kernel, specifically the rawnand driver for Cadence NAND controllers. This driver enables communication with NAND flash memory devices connected to Cadence controllers. The vulnerability in cadence_nand_dt_probe() can lead to a null pointer dereference, potentially causing a system crash or other unpredictable behavior.
Vulnerability Detail
The vulnerability arises from a possible null pointer dereference in the cadence_nand_dt_probe() function of the rawnand driver for Cadence NAND controllers. When certain conditions are met, a null pointer may be dereferenced, leading to a crash or other unexpected behavior. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) attack or execute arbitrary code with kernel privileges. The impact and attack plausibility have not been proven yet, but it is crucial to address this vulnerability to ensure system stability and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the vulnerability by not using the affected rawnand driver for Cadence NAND controllers. However, this may not be feasible in all cases, especially if the driver is necessary for specific hardware configurations. Therefore, it is strongly recommended to apply the fix by updating the Kernel.
Conclusion
The vulnerability in the cadence_nand_dt_probe() function of the rawnand driver for Cadence NAND controllers can lead to a null pointer dereference, potentially causing system instability or unauthorized code execution. It is crucial to update the Linux Kernel to version v5.10.121 or later to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices.
The rawnand driver is a subsystem in the Linux Kernel that enables communication with NAND flash memory devices.
A null pointer dereference occurs when a program attempts to access or manipulate data using a null pointer, which does not point to a valid memory location. This can lead to crashes or other unexpected behavior.
The vulnerability could result in a system crash, denial-of-service (DoS) attack, or arbitrary code execution with kernel privileges.
To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.10.121 or later, which includes the necessary fix for the cadence_nand_dt_probe() function.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
