Vulnerability in drm/virtio package: NULL pointer dereference in virtio_gpu_conn_get_modes
Summary
GSD-2022-1003909: drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes. Affects Kernel versions < edafcad84c4134ebec4bc24b29ca4497a1184eea. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/virtio package is a component of the Linux Kernel that provides support for the VirtIO GPU device. VirtIO GPU is a paravirtualized graphics driver that allows virtual machines to access the host's GPU resources. It enables efficient communication between the guest operating system and the host GPU, providing accelerated graphics capabilities to virtualized environments. However, a vulnerability has been discovered in the virtio_gpu_conn_get_modes function, which can lead to a NULL pointer dereference.
Vulnerability Detail
The vulnerability in the virtio_gpu_conn_get_modes function can be exploited by an attacker to cause a NULL pointer dereference. This occurs when the function fails to handle a NULL pointer properly, leading to a crash or potential privilege escalation. An attacker with local access to a system running the affected version of the Linux Kernel could exploit this vulnerability to crash the system or execute arbitrary code with kernel privileges. The impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
In conclusion, a vulnerability has been discovered in the drm/virtio package of the Linux Kernel, specifically in the virtio_gpu_conn_get_modes function. This vulnerability can lead to a NULL pointer dereference, potentially resulting in a system crash or privilege escalation. It is recommended to update the Linux Kernel to version v4.19.247 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from a system crash to potential privilege escalation, depending on how it is exploited.
An attacker with local access to a system running the affected version of the Linux Kernel can exploit this vulnerability.
No, there is no known proof-of-concept for this vulnerability at the moment.
The recommended mitigation is to update the Linux Kernel to the latest version that includes the fix for this vulnerability.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) entry with ID GSD-2022-1003909.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
