NULL pointer dereference in virtio_gpu_conn_get_modes
Summary
GSD-2022-1004086: drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes. Affects Kernel versions < e0828456578cc8ba0a69147f7ae3428392eec287. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for communication between hardware and software. The virtio_gpu_conn_get_modes function in the drm/virtio module is vulnerable to a NULL pointer dereference. This vulnerability can be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code.
Vulnerability Detail
The vulnerability arises due to a NULL pointer dereference in the virtio_gpu_conn_get_modes function. When this function is called with a NULL pointer as an argument, it can lead to a crash or undefined behavior. An attacker can potentially trigger this vulnerability by sending a specially crafted request to the affected system, causing the function to be called with a NULL pointer. The impact of this vulnerability can range from a system crash to the execution of arbitrary code with kernel-level privileges.
How To Fix
No fixed version is published for this vulnerability.
The vulnerability has been fixed in Linux Kernel version v4.9.318 by commit e0828456578cc8ba0a69147f7ae3428392eec287. To fix the vulnerability, users should update their Kernel to the patched version. This can be done by downloading the updated Kernel source code from the official repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compiling it according to the provided instructions.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a possible workaround is to disable the affected functionality or module. In this case, disabling the virtio_gpu module can prevent the exploitation of this vulnerability. This can be achieved by blacklisting the module or removing it from the Kernel configuration before compiling.
Conclusion
In conclusion, the NULL pointer dereference vulnerability in virtio_gpu_conn_get_modes can lead to a denial-of-service condition or potential code execution. Users are advised to update their Kernel to the patched version or apply the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from a system crash to the execution of arbitrary code with kernel-level privileges.
To fix the vulnerability, users should update their Kernel to the patched version (v4.9.318) by following the provided instructions.
Yes, a possible workaround is to disable the affected virtio_gpu module by blacklisting it or removing it from the Kernel configuration.
At the time of this report, there is no known public exploit for this vulnerability.
For more details about this vulnerability, you can refer to the source link provided in the database_specific section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.