NULL page->mapping dereference in mm/secretmem
Summary
GSD-2021-1002174: mm/secretmem: fix NULL page->mapping dereference in page_is_secretmem(). Affects Kernel versions >= 1507f51255c9ff07d75909a84e7c0d7f3c4b2f49, < 79f9bc5843142b649575f887dccdf1c07ad75c20. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel. It provides the core functionality for the Linux operating system. The mm/secretmem module in the Linux Kernel is responsible for managing secret memory, which is memory that is encrypted and protected from unauthorized access. This vulnerability in mm/secretmem allows for a NULL page->mapping dereference in the page_is_secretmem() function.
Vulnerability Detail
The vulnerability arises from a NULL page->mapping dereference in the page_is_secretmem() function of the mm/secretmem module. This can lead to a kernel crash or potentially be exploited by an attacker to gain unauthorized access or execute arbitrary code. The vulnerability was introduced in Linux Kernel version v5.14 by commit 1507f51255c9ff07d75909a84e7c0d7f3c4b2f49 and is fixed in version v5.15 by commit 79f9bc5843142b649575f887dccdf1c07ad75c20.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The NULL page->mapping dereference vulnerability in mm/secretmem module of the Linux Kernel can lead to a kernel crash or potential unauthorized access. It is recommended to update the Linux Kernel to version v5.15 or later to fix this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a kernel crash or potentially be exploited by an attacker to gain unauthorized access or execute arbitrary code.
The vulnerability was introduced in Linux Kernel version v5.14 by commit 1507f51255c9ff07d75909a84e7c0d7f3c4b2f49.
You can check the version of your Linux Kernel and compare it to the affected versions mentioned in the vulnerability details. Alternatively, you can use vulnerability scanning tools like Vulert to automatically check for vulnerabilities in your software.
Yes, the vulnerability is fixed in Linux Kernel version v5.15 by commit 79f9bc5843142b649575f887dccdf1c07ad75c20.
You can refer to the vulnerability details in the GSD database for more information. The link to the source is provided in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
