Null Pointer Dereference in drm/msm Package
Summary
GSD-2021-1002090: drm/msm: Fix null pointer dereference on pointer edp. Affects Kernel versions >= ab5b0107ccf3821a6837b0f2819270d6fa0b278f, < 46c8ddede0273d1d132beefa9de8b820326982be. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/msm package is a component of the Linux Kernel that provides support for graphics and display functionality on Qualcomm Snapdragon chipsets. It includes drivers for various display interfaces, such as HDMI, DisplayPort, and Embedded DisplayPort (eDP). The package is responsible for managing the communication between the kernel and the graphics hardware, enabling the rendering and output of graphics on supported devices.
Vulnerability Detail
The vulnerability identified as GSD-2021-1002090 in the drm/msm package involves a null pointer dereference on the 'edp' pointer. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code in the context of the kernel. The null pointer dereference occurs when the 'edp' pointer is accessed without proper validation, leading to a crash or other unexpected behavior. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the vulnerability by refraining from performing actions that trigger the null pointer dereference on the 'edp' pointer. However, it is strongly advised to apply the official fix by updating the Linux Kernel to the recommended version.
Conclusion
In conclusion, the null pointer dereference vulnerability in the drm/msm package can lead to a denial-of-service condition or potential execution of arbitrary code in the kernel's context. It is crucial to update the Linux Kernel to version v5.14.14 or later to mitigate this vulnerability. Users can also utilize the Vulert Playground to check if their systems are affected by this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from a denial-of-service (DoS) condition to potential execution of arbitrary code in the kernel's context. However, the exact impact and attack plausibility have not been proven yet.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and the Vulert Playground will provide real-time alerts for open-source vulnerabilities, including this one.
Yes, a workaround is available. Users can avoid triggering the null pointer dereference on the 'edp' pointer by refraining from performing specific actions that lead to the vulnerability. However, it is strongly recommended to apply the official fix by updating the Linux Kernel to the recommended version.
The remote exploitability of this vulnerability has not been determined yet. Further analysis is required to assess the potential for remote exploitation.
You can find more information about this vulnerability, including the specific commit that fixed it, in the GSD-2021-1002090 entry of the GSD database. The database is maintained by the Cloud Security Alliance and can be accessed at https://github.com/cloudsecurityalliance/gsd-database.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
