ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
Summary
GSD-2022-1004845: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo(). Affects Kernel versions < a810bd5af06977a847d1f202b22d7defd5c62497. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel package is responsible for managing the core functionality of the Linux operating system. It provides essential services and interfaces for hardware, device drivers, and system processes. The specific vulnerability, identified as GSD-2022-1004845, is related to the libata-core component within the Kernel package.
Vulnerability Detail
The vulnerability in libata-core, known as ata_host_alloc_pinfo(), involves a NULL pointer dereference. This occurs when allocating memory for the ATA host port information structure. An attacker could exploit this vulnerability by sending specially crafted input to a vulnerable system, leading to a NULL pointer dereference and potentially resulting in a system crash or other unexpected behavior. The impact and attack plausibility of this vulnerability have not been proven. The vulnerability has been fixed in Linux Kernel version v4.19.249 by commit a810bd5af06977a847d1f202b22d7defd5c62497.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in libata-core within the Kernel package has been addressed in Linux Kernel version v4.19.249. Users are advised to update their Kernel package to this version or later to mitigate the risk. For further support or assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, it could potentially lead to a system crash or unexpected behavior.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including GSD-2022-1004845.
No specific workaround has been provided for this vulnerability. It is recommended to update to the fixed version of the Linux Kernel.
More details about the fix can be found in the commit a810bd5af06977a847d1f202b22d7defd5c62497 in the Linux Kernel Git repository.
To update the Linux Kernel, you can obtain the updated source code from the official Git repository and compile it for your system. Alternatively, you can wait for your Linux distribution to provide an updated package that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
