Vulnerability in Kernel (Linux): hwmon (w83791d) NULL Pointer Dereference
Summary
UVI-2021-1001599: hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field. Affects Kernel versions < 44d3c480e4e2a75bf6296a18b4356157991ccd80. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionalities for the proper functioning of the system. The hwmon subsystem within the Kernel is responsible for monitoring hardware sensors and reporting their data to user-space applications. One of the modules in the hwmon subsystem is w83791d, which specifically handles monitoring for the W83791D chip. This chip is commonly found on motherboards and provides sensor readings for temperature, voltage, and fan speeds. However, a vulnerability has been discovered in the w83791d module that can lead to a NULL pointer dereference.
Vulnerability Detail
The vulnerability in the w83791d module of the Kernel arises from an unnecessary structure field that can result in a NULL pointer dereference. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with kernel privileges. By sending specially crafted input to the affected system, an attacker can trigger the NULL pointer dereference, leading to a system crash or other unpredictable behavior. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the w83791d module of the Kernel can lead to a NULL pointer dereference, potentially resulting in a denial-of-service (DoS) condition or arbitrary code execution with kernel privileges. It is crucial to update the Kernel to version v5.4.151 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from a denial-of-service (DoS) condition, where the system crashes or becomes unresponsive, to potential execution of arbitrary code with kernel privileges. However, the actual impact and attack plausibility have not been proven yet.
An attacker can exploit this vulnerability by sending specially crafted input to the affected system, triggering the NULL pointer dereference in the w83791d module. This can lead to a system crash or other unpredictable behavior.
Yes, this vulnerability has been fixed in the Linux Kernel version v5.4.151 through the commit 44d3c480e4e2a75bf6296a18b4356157991ccd80.
To protect your system, it is recommended to update your Kernel to version v5.4.151 or later. Follow the instructions provided in the Kernel documentation to compile and install the updated Kernel.
You can find more information about this vulnerability in the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and the associated commit 44d3c480e4e2a75bf6296a18b4356157991ccd80.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
