ACPI: fix NULL pointer dereference in Kernel
Summary
GSD-2021-1001172: ACPI: fix NULL pointer dereference. Affects Kernel versions < ccf23a0888077a25a0793a746c3941db2a7562e4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. ACPI (Advanced Configuration and Power Interface) is a standard that defines hardware interfaces for power management and configuration. It is implemented in the Kernel to facilitate power management operations.
However, a vulnerability has been identified in the ACPI implementation of the Kernel, which can lead to a NULL pointer dereference. This vulnerability could potentially be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code with kernel privileges.
Vulnerability Detail
The vulnerability in the ACPI implementation of the Kernel arises due to a NULL pointer dereference. When certain conditions are met, a NULL pointer is accessed, leading to a system crash or potential code execution with elevated privileges. The impact of this vulnerability can range from a system freeze to a complete compromise of the affected system.
The vulnerability has been assigned the ID GSD-2021-1001172 and is fixed in Linux Kernel version v5.13.6 by commit ccf23a0888077a25a0793a746c3941db2a7562e4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable ACPI functionality in the Kernel configuration. This can be achieved by modifying the Kernel configuration file and removing the ACPI-related options. However, disabling ACPI may result in the loss of power management capabilities and other related features.
Conclusion
In conclusion, a vulnerability has been discovered in the ACPI implementation of the Kernel, which can result in a NULL pointer dereference. This vulnerability can lead to a system crash or potential code execution with elevated privileges. It is crucial to update the Kernel to version v5.13.6 or later to mitigate the risk. Alternatively, users can apply the temporary workaround of disabling ACPI functionality in the Kernel configuration. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a system crash or potential code execution with elevated privileges, potentially allowing an attacker to compromise the affected system.
You can use tools like Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert Playground allows you to analyze your software without requiring access to the code or installation.
Yes, a temporary workaround is to disable ACPI functionality in the Kernel configuration. However, this may result in the loss of power management capabilities and other related features.
The fixed version of the Kernel (v5.13.6 or later) can be obtained from the official Git repository of the Linux Kernel (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/).
If you are unable to update the Kernel immediately, it is recommended to apply the temporary workaround of disabling ACPI functionality in the Kernel configuration to mitigate the risk until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
