Vulnerability in comedi: ni_usb6501
Summary
GSD-2021-1001949: comedi: ni_usb6501: fix NULL-deref in command paths. Affects Kernel versions >= a03bb00e50ab4c07107da58a52a0bff7943f360c, < aa39738423503825625853b643b9e99d11c23816. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The comedi package is a collection of drivers and libraries for data acquisition devices. One of the drivers, ni_usb6501, is used for National Instruments USB-6501 devices. These devices provide digital I/O capabilities for various applications. However, a vulnerability has been discovered in the ni_usb6501 driver that could lead to a NULL-dereference issue in command paths.
Vulnerability Detail
The vulnerability in the ni_usb6501 driver allows an attacker to trigger a NULL-dereference, potentially leading to a system crash or privilege escalation. This vulnerability was introduced in Linux Kernel version v3.18 and has been fixed in version v4.9.290. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the comedi package's ni_usb6501 driver has a vulnerability that could lead to a NULL-dereference issue. It is recommended to update the Linux Kernel to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Comedi is a collection of drivers and libraries for data acquisition devices.
ni_usb6501 is a driver used for National Instruments USB-6501 devices, which provide digital I/O capabilities.
A NULL-dereference occurs when a program attempts to access or manipulate memory using a null pointer, resulting in a crash or potential security vulnerability.
The impact of this vulnerability could range from a system crash to potential privilege escalation, depending on the attacker's capabilities.
To fix this vulnerability, update the Linux Kernel to version v4.9.290 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
