ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
Summary
GSD-2022-1004766: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo(). Affects Kernel versions < 253334f84c81bc6a43af489f108c0bddad989eef. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel package is responsible for providing the core functionality of the Linux operating system. It includes various components, such as device drivers, memory management, and process scheduling. The specific vulnerability, identified as GSD-2022-1004766, is related to the libata-core module within the Kernel package.
Vulnerability Detail
The vulnerability in libata-core, known as ata_host_alloc_pinfo(), involves a NULL pointer dereference. This occurs when allocating memory for the ATA host port information structure. An attacker could exploit this vulnerability by sending specially crafted input to a system with a vulnerable version of the Kernel package. Successful exploitation could lead to a system crash or potentially allow the attacker to execute arbitrary code with kernel-level privileges. The vulnerability has been fixed in Linux Kernel version v5.4.200 by commit 253334f84c81bc6a43af489f108c0bddad989eef.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the vulnerability in libata-core within the Kernel package could lead to system crashes or potential code execution by an attacker. It is crucial to update the Linux Kernel package to version v5.4.200 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could result in a system crash or allow an attacker to execute arbitrary code with kernel-level privileges.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and Vulert will analyze it in real-time.
No specific workaround has been provided for this vulnerability. It is recommended to update the Linux Kernel package to the fixed version.
You can refer to the commit 253334f84c81bc6a43af489f108c0bddad989eef in the Linux Kernel repository for more details about the fix.
The vulnerability was discovered by an automated process and reported in the GSD-2022-1004766 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
