USB Null Pointer Dereference Vulnerability in Linux Kernel
Summary
GSD-2021-1000861: usb: fix various gadgets null ptr deref on 10gbps cabling. Affects Kernel versions >= eaef50c760576bca70b87fdc26eb87a3660529f8, < 8cd5f45c1b769e3e9e0f4325dd08b6c3749dc7ee. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for hardware interaction, process management, and system resource allocation. The USB subsystem within the Linux Kernel enables the use of USB devices and includes support for USB gadgets, which allow the system to act as a USB device. However, a vulnerability has been discovered in the USB gadget implementation that can lead to null pointer dereference when operating at 10Gbps speeds.
Vulnerability Detail
The USB null pointer dereference vulnerability in the Linux Kernel occurs when certain USB gadgets are used with 10Gbps cabling. This can result in a null pointer dereference, leading to a system crash or potential privilege escalation. An attacker with physical access to a vulnerable system could exploit this vulnerability to cause a denial-of-service condition or execute arbitrary code with elevated privileges. The vulnerability was introduced in version 4.6 of the Linux Kernel and has been fixed in version 4.14.237.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the patch or update the Linux Kernel to mitigate the risk.
Conclusion
The USB null pointer dereference vulnerability in the Linux Kernel can result in a system crash or potential privilege escalation. It is crucial to update the Linux Kernel to version 4.14.237 or later to mitigate the risk. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a system crash or potential privilege escalation, allowing an attacker to execute arbitrary code with elevated privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
Yes, the vulnerability is specific to certain USB gadgets when used with 10Gbps cabling.
No, this vulnerability requires physical access to a vulnerable system.
There are no known instances of this vulnerability being exploited in the wild.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
