PT-2022-7613 · Linux+3 · Linux Kernel+3
Zhou Qingyang
·
Published
2022-02-08
·
Updated
2024-09-27
·
CVE-2021-4441
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to the fix commit
Description
The issue is related to a NULL pointer dereference in the
zynq qspi exec mem op() function. This occurs because kzalloc() is directly used in memset(), which could lead to a NULL pointer dereference on failure of kzalloc(). The bug was found by a static analyzer using differential checking to identify inconsistent security operations between two code paths. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug.Recommendations
To resolve the issue, upgrade to versions released after March 2022. Ensure your systems are updated to protect against potential exploits. As a temporary workaround, consider adding a check of
tmpbuf in the zynq qspi exec mem op() function to prevent the NULL pointer dereference.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse