Null Pointer Dereference in video: fbdev: smscufx
Summary
GSD-2022-1002508: video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe(). Affects Kernel versions >= 3c8a63e22a0802fd56380f6ab305b419f18eb6f5, < d1b6a1f0c23b7164250479bf92e2893291dca539. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The video: fbdev: smscufx package is a component of the Linux Kernel, which is responsible for handling video display on devices using the Framebuffer device interface. It provides support for various video hardware, including the SMSC UFX USB Display Adapter. The vulnerability in this package involves a null pointer dereference in the ufx_usb_probe() function.
Vulnerability Detail
The null pointer dereference vulnerability in video: fbdev: smscufx's ufx_usb_probe() function can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code. By sending a specially crafted USB device to a vulnerable system, an attacker can trigger the null pointer dereference, leading to a system crash or potential code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix or update the Linux Kernel to a version that includes the fix.
Conclusion
The null pointer dereference vulnerability in video: fbdev: smscufx's ufx_usb_probe() function can have severe consequences, including system crashes and potential code execution. It is crucial to update the Linux Kernel to a fixed version or apply the provided commit to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial-of-service (DoS) condition or potential code execution on systems using the video: fbdev: smscufx package.
An attacker can exploit this vulnerability by sending a specially crafted USB device to a vulnerable system, triggering the null pointer dereference and potentially causing a system crash or executing arbitrary code.
Yes, the vulnerability can be fixed by updating the Linux Kernel to version v4.9.311 or later. Alternatively, users can apply the specific commit (d1b6a1f0c23b7164250479bf92e2893291dca539) that addresses this vulnerability.
No, there are no known workarounds for this vulnerability. It is crucial to apply the provided fix or update the Linux Kernel to a version that includes the fix.
For more information about this vulnerability, you can refer to the official Linux Kernel repository or the vulnerability database entry at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002508.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
