PCI: endpoint: Fix NULL pointer dereference for ->get_features() in Kernel
Summary
UVI-2021-1000335: PCI: endpoint: Fix NULL pointer dereference for ->get_features(). Affects Kernel versions >= 2c04c5b8eef797dca99699cfb55ff42dd3c12c23, < bbed83d7060e07a5d309104d25a00f0a24441428. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionality and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the overall stability and security of the system. The PCI (Peripheral Component Interconnect) subsystem in the Kernel enables communication between devices connected to the PCI bus. The PCI endpoint driver is responsible for managing PCI devices that function as endpoints. These devices can be found in various hardware components, such as network adapters, sound cards, and storage controllers.
Vulnerability Detail
The vulnerability identified as UVI-2021-1000335 in the Kernel's PCI endpoint driver involves a NULL pointer dereference issue in the ->get_features() function. This vulnerability was introduced in version v5.1 of the Kernel by commit 2c04c5b8eef797dca99699cfb55ff42dd3c12c23 and was fixed in version v5.10.38 by commit bbed83d7060e07a5d309104d25a00f0a24441428. The vulnerability occurs when the ->get_features() function is called on a NULL pointer, leading to a crash or system instability. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability UVI-2021-1000335 in the Kernel's PCI endpoint driver involves a NULL pointer dereference issue. It is crucial to update the Kernel to version v5.10.38 or later to mitigate the risk associated with this vulnerability. Promptly applying security patches and updates is essential to ensure the stability and security of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific system and its usage. It could potentially lead to crashes, system instability, or even remote code execution if an attacker can exploit the NULL pointer dereference issue.
You can check if your system is affected by this vulnerability by verifying the version of the Kernel installed. If your system is running a version prior to v5.10.38, it is likely vulnerable. Additionally, you can use vulnerability scanning tools or services like Vulert (https://vulert.com) to assess the vulnerability status of your system.
As of now, there are no known exploits for this vulnerability. However, it is always recommended to apply security patches and updates promptly to mitigate the risk of potential exploits.
No specific workaround has been provided for this vulnerability. It is advised to update the Kernel to the fixed version as mentioned in the 'how_to_fix' section.
You can find more information about this vulnerability, including its technical details and the specific commits that introduced and fixed it, in the vulnerability database maintained by the Cloud Security Alliance. The source link is provided in the 'affected' section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
