Vulnerability in comedi: ni_usb6501
Summary
GSD-2021-1001929: comedi: ni_usb6501: fix NULL-deref in command paths. Affects Kernel versions >= a03bb00e50ab4c07107da58a52a0bff7943f360c, < 58478143771b20ab219937b1c30a706590a59224. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The comedi package is a Linux kernel subsystem that provides a unified interface for data acquisition and control devices. It allows userspace programs to interact with various hardware devices, including the ni_usb6501 device. The ni_usb6501 is a USB-based digital I/O device that provides 24 lines of digital I/O and two 32-bit counters. It is commonly used in industrial automation and scientific research applications. However, a vulnerability has been discovered in the ni_usb6501 driver, which could lead to a NULL-dereference error in certain command paths.
Vulnerability Detail
The vulnerability in the ni_usb6501 driver arises from a NULL-dereference error in specific command paths. This error can be triggered by a malicious user or a specially crafted input. If successfully exploited, it could result in a system crash or potentially allow an attacker to execute arbitrary code with kernel-level privileges. The vulnerability was introduced in Linux Kernel version v3.18 and is fixed in version v4.4.292 by commit 58478143771b20ab219937b1c30a706590a59224.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version as soon as possible.
Conclusion
The vulnerability in the comedi ni_usb6501 driver can lead to a NULL-dereference error, potentially resulting in a system crash or arbitrary code execution. It is crucial to update the Linux Kernel to version v4.4.292 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Comedi is a Linux kernel subsystem that provides a unified interface for data acquisition and control devices. It allows userspace programs to interact with various hardware devices.
ni_usb6501 is a USB-based digital I/O device that provides 24 lines of digital I/O and two 32-bit counters. It is commonly used in industrial automation and scientific research applications.
A NULL-dereference error occurs when a program attempts to access or manipulate memory using a null pointer, which does not point to a valid memory location. This can lead to crashes or security vulnerabilities.
If successfully exploited, this vulnerability could result in a system crash or allow an attacker to execute arbitrary code with kernel-level privileges.
To fix this vulnerability, update the Linux Kernel to version v4.4.292 or later. Follow the provided installation instructions or use your Linux distribution's package manager to apply updates.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
