Null Pointer Dereference in com20020pci_probe() in net: arcnet: com20020
Summary
GSD-2022-1000919: net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe(). Affects Kernel versions >= 8c14f9c70327a6fb75534c4c61d7ea9c82ccf78f, < b1ee6b9340a38bdb9e5c90f0eac5b22b122c3049. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com20020 driver is a network driver for the ARCnet protocol. It is responsible for managing communication between devices using the com20020 chipset. The vulnerability in question is a null pointer dereference issue that occurs in the com20020pci_probe() function. This function is called during the initialization of the com20020 driver for PCI devices. The vulnerability allows an attacker to trigger a null pointer dereference, leading to a kernel crash or potential privilege escalation.
Vulnerability Detail
The null pointer dereference vulnerability in com20020pci_probe() arises from a failure to handle a null pointer properly. When the function is called, it does not check if a required data structure is properly initialized, leading to a null pointer dereference. An attacker can exploit this vulnerability by sending specially crafted packets to a vulnerable system, causing the driver to access the null pointer and potentially crashing the kernel or executing arbitrary code with kernel privileges. The impact of this vulnerability can range from denial of service to full system compromise.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.14.270 or later. This fix is implemented in commit b1ee6b9340a38bdb9e5c90f0eac5b22b122c3049. Updating the kernel will ensure that the null pointer dereference issue in com20020pci_probe() is addressed.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the kernel is not immediately possible, a temporary workaround can be implemented by disabling the com20020 driver or removing the affected hardware from the system. This can be achieved by blacklisting the com20020 module or modifying the system's hardware configuration.
Conclusion
The null pointer dereference vulnerability in com20020pci_probe() poses a significant risk to systems utilizing the com20020 driver for ARCnet communication. It is crucial to update the Linux Kernel to the recommended version or implement the provided workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The com20020 driver is a network driver for the ARCnet protocol, responsible for managing communication between devices using the com20020 chipset.
A null pointer dereference occurs when a program attempts to access or manipulate data through a null pointer, resulting in a crash or potential security vulnerability.
An attacker can exploit this vulnerability by sending specially crafted packets to a vulnerable system, triggering a null pointer dereference in the com20020 driver and potentially crashing the kernel or executing arbitrary code with kernel privileges.
The impact of this vulnerability can range from denial of service, where the kernel crashes, to full system compromise, where an attacker gains control over the affected system.
To fix this vulnerability, update the Linux Kernel to version v4.14.270 or later, which includes the necessary fix for the null pointer dereference in com20020pci_probe().
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.