USB Null Pointer Dereference Vulnerability in Linux Kernel
Summary
GSD-2021-1000878: usb: fix various gadgets null ptr deref on 10gbps cabling. Affects Kernel versions >= eaef50c760576bca70b87fdc26eb87a3660529f8, < 10770d2ac0094b053c8897d96d7b2737cd72f7c5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. USB (Universal Serial Bus) is a widely used interface for connecting devices to computers. The Linux Kernel includes support for USB gadgets, which are devices that act as USB peripherals. These gadgets can be vulnerable to null pointer dereference issues when operating at 10Gbps speeds.
Vulnerability Detail
The USB null pointer dereference vulnerability in the Linux Kernel occurs when certain USB gadgets are used with 10Gbps cabling. This vulnerability can be exploited by an attacker to cause a null pointer dereference, leading to a system crash or potential code execution. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in version v4.6 of the Linux Kernel and was fixed in version v4.19.195 by commit 10770d2ac0094b053c8897d96d7b2737cd72f7c5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The USB null pointer dereference vulnerability in the Linux Kernel poses a potential security risk for systems using certain USB gadgets at 10Gbps speeds. It is recommended to update the Linux Kernel to version v4.19.195 or later to fix this vulnerability. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from a system crash to potential code execution, depending on how it is exploited.
An attacker can exploit this vulnerability by sending specially crafted USB traffic to a vulnerable USB gadget operating at 10Gbps speeds.
No evidence of active exploitation of this vulnerability has been reported so far.
No, only certain USB gadgets operating at 10Gbps speeds are vulnerable to this issue.
Disabling USB gadgets can mitigate the risk of exploitation, but it may not be a feasible solution for systems that rely on USB gadget functionality.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
