dmaengine: idxd: Fix potential null dereference on pointer status (Linux Linux)

CVE-2021-47003
MEDIUM 5.5

At a glance

Source
NVD
EPSS
EPSS 0.24 % · percentile 15 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Analyzed

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix potential null dereference on pointer status There are calls to idxd_cmd_exec that pass a null status pointer however a recent commit has added an assignment to *status that can end up with a null pointer dereference. The function expects a null status pointer sometimes as there is a later assignment to *status where status is first null checked. Fix the issue by null checking status before making the assignment. Addresses-Coverity: ("Explicit null dereferenced")

Weaknesses (CWE)

  • CWE-476 — NULL Pointer Dereference

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected 40e3b5c128645d2ddad12310c7be98758cafb2b0 < 5756f757c72501ef1a16f5f63f940623044180e9 ; affected 89e3becd8f821e507052e012d2559dcda59f538e < 2280b4cc29d8cdd2be3d1b2d1ea4f958e2131c97 ; affected 89e3becd8f821e507052e012d2559dcda59f538e < 7bc402f843e7817a4a808e7b9ab0bcd7ffd55bfa ; affected 89e3becd8f821e507052e012d2559dcda59f538e < 28ac8e03c43dfc6a703aa420d18222540b801120 ; affected 5.10.17 < 5.10.38
Linux · Linuxaffected 5.11 ; unaffected 0 < 5.11 ; unaffected 5.10.38 ≤ 5.10.* ; unaffected 5.11.22 ≤ 5.11.* ; unaffected 5.12.5 ≤ 5.12.* ; unaffected 5.13 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD