Null Pointer Dereference in alcor_pci Package
Summary
GSD-2021-1001339: misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge. Affects Kernel versions < d2639ffdcad463b358b6bef8645ff81715daffcb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The alcor_pci package is a component of the Linux Kernel, which is responsible for handling PCI bridges. PCI bridges are hardware devices that connect peripheral devices to the computer's motherboard. The alcor_pci package provides functionality for managing these bridges and their associated devices. However, a vulnerability has been discovered in the package that can lead to a null pointer dereference when there is no PCI bridge present.
Vulnerability Detail
The vulnerability in the alcor_pci package arises when the code attempts to access a null pointer, resulting in a null pointer dereference. This can occur when there is no PCI bridge detected in the system. An attacker could potentially exploit this vulnerability to cause a denial of service (system crash) or execute arbitrary code with kernel privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a possible workaround is to disable the alcor_pci module by blacklisting it. This can be done by adding the following line to the /etc/modprobe.d/blacklist.conf file:
blacklist alcor_pci
After adding the line, restart the system for the changes to take effect. However, it is recommended to update the kernel as soon as possible to ensure the vulnerability is fully addressed.
Conclusion
The null pointer dereference vulnerability in the alcor_pci package can be mitigated by updating the Linux Kernel to version v5.4.134 or later. Alternatively, users can apply a workaround by blacklisting the alcor_pci module. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The alcor_pci package is a component of the Linux Kernel that handles PCI bridges and their associated devices.
A null pointer dereference occurs when a program attempts to access or manipulate data through a null pointer, resulting in a crash or undefined behavior.
The impact of this vulnerability can range from a denial of service (system crash) to potential execution of arbitrary code with kernel privileges.
To fix this vulnerability, update your Linux Kernel to version v5.4.134 or later.
Yes, a possible workaround is to disable the alcor_pci module by blacklisting it.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
