Vulnerability in pinctrl: aspeed package - Potential NULL Dereference in aspeed_pinmux_set_mux()
Summary
GSD-2022-1004161: pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux(). Affects Kernel versions < e162a24f1dd06c0dcae71f2565c9f3da2827b98e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pinctrl: aspeed package is a component of the Linux Kernel that provides pin control and pinmux functionality for ASPEED SoCs. It allows for the configuration of pin multiplexing, which determines the function of each pin on the system. This package is widely used in systems utilizing ASPEED SoCs, such as servers, networking devices, and embedded systems. However, a potential vulnerability has been identified in the aspeed_pinmux_set_mux() function, which could lead to a NULL dereference.
Vulnerability Detail
The vulnerability arises from a potential NULL dereference in the aspeed_pinmux_set_mux() function within the pinctrl: aspeed package. If a certain condition is met, the function may attempt to dereference a NULL pointer, leading to a system crash or potential code execution. The impact and attack plausibility of this vulnerability have not been proven, but it is crucial to address it to ensure system stability and security. The vulnerability has been fixed in Linux Kernel version v5.18.13 by commit e162a24f1dd06c0dcae71f2565c9f3da2827b98e.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the fix by updating the Linux Kernel as mentioned in the 'how_to_fix' section.
Conclusion
The pinctrl: aspeed package in the Linux Kernel is vulnerable to a potential NULL dereference in the aspeed_pinmux_set_mux() function. To mitigate this vulnerability, it is crucial to update the Linux Kernel to version v5.18.13 or later. This will ensure system stability and security. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The pinctrl: aspeed package is a component of the Linux Kernel that provides pin control and pinmux functionality for ASPEED SoCs.
Pin multiplexing refers to the configuration of pins on a system to perform different functions based on the desired functionality.
A NULL dereference occurs when a program attempts to access or manipulate memory using a pointer that is not pointing to a valid memory location (i.e., NULL). This can lead to crashes or potential code execution.
The potential ramifications of this vulnerability include system crashes, instability, or potential code execution, depending on the specific conditions and attacker capabilities.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
