Null Pointer Dereference in alcor_pci when No PCI Bridge is Present
Summary
UVI-2021-1001280: misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge. Affects Kernel versions < 58f69684ba03e5b0e0a3ae844a845280c0f06309. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The alcor_pci is a module in the Linux Kernel that provides support for Alcor Micro PCI Express Card Reader Controller. It allows the system to communicate with PCI devices connected to the Alcor Micro controller. The module is responsible for managing the PCI bridge and handling data transfers between the system and the connected devices. However, a vulnerability has been discovered in the alcor_pci module when there is no PCI bridge present.
Vulnerability Detail
The vulnerability in alcor_pci module arises from a null pointer dereference issue. When there is no PCI bridge detected, the module fails to handle this scenario properly, resulting in a null pointer dereference. An attacker could exploit this vulnerability by sending specially crafted requests to the system, causing it to crash or potentially execute arbitrary code with kernel-level privileges. The impact of this vulnerability depends on the attacker's ability to exploit the null pointer dereference and the system's configuration.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the kernel is not immediately feasible, a possible workaround is to disable the alcor_pci module if it is not required for the system's operation. This can be achieved by blacklisting the module or preventing it from loading during system startup. However, this workaround should be considered temporary, and updating the kernel to the patched version is still recommended.
Conclusion
The null pointer dereference vulnerability in the alcor_pci module can be mitigated by updating the Linux Kernel to version v5.10.52 or later. This ensures that the module handles the absence of a PCI bridge correctly, preventing potential crashes or unauthorized code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The alcor_pci module is a component of the Linux Kernel that provides support for Alcor Micro PCI Express Card Reader Controller. It allows the system to communicate with PCI devices connected to the Alcor Micro controller.
A null pointer dereference occurs when a program attempts to access or manipulate memory using a null pointer, which does not point to a valid memory location. This can lead to crashes, unexpected behavior, or potential security vulnerabilities.
An attacker can exploit this vulnerability by sending specially crafted requests to the system, triggering the null pointer dereference in the alcor_pci module. This could potentially lead to system crashes or the execution of arbitrary code with kernel-level privileges.
The impact of this vulnerability depends on the attacker's ability to exploit the null pointer dereference and the system's configuration. It could result in system crashes, denial of service, or the execution of arbitrary code with kernel-level privileges.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.52 or later. The fix for this issue was implemented in commit 58f69684ba03e5b0e0a3ae844a845280c0f06309.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
