NULL pointer dereference in spi-zynq-qspi
Summary
GSD-2022-1000804: spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op(). Affects Kernel versions >= 67dca5e580f1e93a66177389981541cac208c817, < 3c32405d6474a21f7d742828e73c13e326dcae82. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spi-zynq-qspi is a driver in the Linux Kernel that provides support for the Quad SPI (QSPI) controller found in Xilinx Zynq platforms. The QSPI controller allows for high-speed serial communication with external flash memory devices. This vulnerability affects versions of the Linux Kernel from v5.2 to v5.15.25, and it was introduced in commit 67dca5e580f1e93a66177389981541cac208c817.
Vulnerability Detail
The vulnerability is a NULL pointer dereference in the zynq_qspi_exec_mem_op() function of the spi-zynq-qspi driver. This occurs when the driver attempts to execute a memory operation but encounters a NULL pointer, leading to a system crash or potential privilege escalation. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
The vulnerability has been fixed in Linux Kernel version v5.15.26 by commit 3c32405d6474a21f7d742828e73c13e326dcae82. To fix the vulnerability, users should update their Linux Kernel to version v5.15.26 or later.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The NULL pointer dereference vulnerability in spi-zynq-qspi can lead to system crashes or potential privilege escalation. It is crucial to update the Linux Kernel to version v5.15.26 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
spi-zynq-qspi is a driver in the Linux Kernel that provides support for the Quad SPI (QSPI) controller found in Xilinx Zynq platforms. It enables high-speed serial communication with external flash memory devices.
A NULL pointer dereference occurs when a program attempts to access or manipulate data through a pointer that is null (i.e., it does not point to any valid memory location). This can lead to crashes or potential security vulnerabilities.
The impact of this vulnerability is a system crash or potential privilege escalation. However, the actual impact and attack plausibility have not been proven yet.
To fix this vulnerability, users should update their Linux Kernel to version v5.15.26 or later, which includes the necessary fix for the NULL pointer dereference.
No specific workaround has been provided for this vulnerability. Updating the Linux Kernel to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.