Null Pointer Dereference in com20020pci_probe() in net: arcnet: com20020
Summary
GSD-2022-1000827: net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe(). Affects Kernel versions >= 8c14f9c70327a6fb75534c4c61d7ea9c82ccf78f, < 5f394102ee27dbf051a4e283390cd8d1759dacea. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com20020 driver is a network driver for the ARCnet protocol. ARCnet is a local area network (LAN) protocol that was popular in the 1980s and early 1990s. The com20020 driver provides support for the COM20020/COM20022 ARCnet controller chips. These chips are commonly found in embedded systems and industrial control applications. The com20020pci_probe() function is responsible for initializing the com20020 driver when it is used with a PCI bus. However, a null pointer dereference vulnerability exists in this function, which can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code.
Vulnerability Detail
The null pointer dereference vulnerability in com20020pci_probe() occurs when the function attempts to dereference a null pointer, leading to a crash or potentially allowing an attacker to execute arbitrary code. This vulnerability can be triggered when the com20020 driver is used with a PCI bus and a specific sequence of operations is performed. An attacker with local access to a vulnerable system could exploit this vulnerability to crash the system or gain elevated privileges. The impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
In conclusion, the com20020 driver in the Linux Kernel is vulnerable to a null pointer dereference in the com20020pci_probe() function. This vulnerability can potentially lead to a denial-of-service (DoS) condition or allow an attacker to execute arbitrary code. It is recommended to update the Linux Kernel to version v5.10.104 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The com20020 driver is a network driver for the ARCnet protocol, providing support for the COM20020/COM20022 ARCnet controller chips.
ARCnet is a local area network (LAN) protocol that was popular in the 1980s and early 1990s.
A null pointer dereference vulnerability occurs when a program attempts to dereference a null pointer, leading to a crash or potentially allowing an attacker to execute arbitrary code.
The impact of this vulnerability is currently unknown. It could potentially lead to a denial-of-service (DoS) condition or allow an attacker to execute arbitrary code.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
