Vulnerability in iommu/omap Package: NULL Pointer Dereference
Summary
GSD-2022-1001354: iommu/omap: Fix regression in probe for NULL pointer dereference. Affects Kernel versions >= 6785eb9105e3363aa51408c700a55e8b5f88fcf6, < ea518578aa8a9a0280605b53cc33f707e10c8178. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The iommu/omap package is a component of the Linux Kernel, which provides support for Input-Output Memory Management Units (IOMMUs) on OMAP-based systems. IOMMUs are responsible for managing memory access and translation between devices and the CPU. The iommu/omap package is crucial for ensuring secure and efficient data transfer between devices and the CPU in OMAP-based systems.
Vulnerability Detail
The identified vulnerability in the iommu/omap package is a regression in the probe function that leads to a NULL pointer dereference. This vulnerability was introduced in version v5.8 of the Linux Kernel by commit 6785eb9105e3363aa51408c700a55e8b5f88fcf6 and affects all subsequent versions until it was fixed in v5.16.20 by commit ea518578aa8a9a0280605b53cc33f707e10c8178. A NULL pointer dereference occurs when a program attempts to access or manipulate data using a pointer that points to NULL, resulting in a system crash or potential code execution. Exploiting this vulnerability could lead to a denial-of-service (DoS) attack or potential privilege escalation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the iommu/omap module if it is not essential for their system's functionality. This can be done by blacklisting the module or removing it from the kernel configuration. However, it is important to note that this workaround may impact the functionality or performance of certain OMAP-based systems.
Conclusion
The vulnerability in the iommu/omap package, leading to a NULL pointer dereference, poses a potential security risk for OMAP-based systems. It is crucial to update the Linux Kernel to version v5.16.20 or later to mitigate this vulnerability. Users can also check if their application is affected by this vulnerability using the Vulert Playground (https://vulert.com/scanner) without requiring access to the code or installation.
See every vulnerability recorded for Kernel →
FAQ
The iommu/omap package is a component of the Linux Kernel that provides support for Input-Output Memory Management Units (IOMMUs) on OMAP-based systems. It ensures secure and efficient data transfer between devices and the CPU.
A NULL pointer dereference occurs when a program attempts to access or manipulate data using a pointer that points to NULL. This can lead to a system crash or potential code execution.
Exploiting this vulnerability could lead to a denial-of-service (DoS) attack or potential privilege escalation. An attacker could craft malicious input to trigger the NULL pointer dereference and crash the system or execute arbitrary code.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.16.20 or later. Fetch the latest stable version from the official repository and apply the necessary patches.
As a temporary workaround, users can disable the iommu/omap module if it is not essential for their system's functionality. This can be done by blacklisting the module or removing it from the kernel configuration.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
