Null Pointer Dereference in com20020pci_probe() in net: arcnet: com20020
Summary
GSD-2022-1000697: net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe(). Affects Kernel versions >= 8c14f9c70327a6fb75534c4c61d7ea9c82ccf78f, < ca0bdff4249a644f2ca7a49d410d95b8dacf1f72. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com20020 driver is a network driver for the ARCnet protocol. It is used to communicate with ARCnet devices, such as the com20020 PCI card. The com20020pci_probe() function is responsible for probing and initializing the com20020 PCI card. However, a vulnerability exists in this function that can lead to a null pointer dereference.
Vulnerability Detail
The vulnerability occurs when the com20020pci_probe() function is called with a null pointer as an argument. This can happen if the PCI subsystem fails to allocate memory for the com20020 device structure. As a result, when the function tries to access the device structure, a null pointer dereference occurs, leading to a system crash or potential privilege escalation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to a fixed version of the Linux Kernel is the recommended solution.
Conclusion
The null pointer dereference vulnerability in com20020pci_probe() in the net: arcnet: com20020 driver can lead to a system crash or potential privilege escalation. It is recommended to update to the fixed version of the Linux Kernel to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a system crash or potential privilege escalation.
You can use the Vulert playground at Vulert Scanner to check if your system is affected by this vulnerability.
Yes, a patch has been released in the Linux Kernel version v5.16.13.
There are no known exploits for this vulnerability at this time.
Yes, this vulnerability can be exploited remotely if an attacker can send malicious packets to the vulnerable system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
