Description
In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machine_kexec_prepare() A NULL pointer dereference issue is noticed in riscv's machine_kexec_prepare(), where image->segment[i].buf might be NULL and copied unchecked. The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without a check in machine_kexec_prepare(): kexec_file_load -> kimage_file_alloc_init() -> kimage_file_prepare_segments() -> ima_add_kexec_buffer() -> kexec_add_buffer() -> machine_kexec_prepare() -> memcpy() Address this by adding a check before the data copy attempt.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
4211742f0f9e083188f4f0ada00d6eeeef31b7c7 to < 606cc45e871e34b80a2f63874f069387a5b44176affectedb7fb4d78a6ade6026d9e5cf438c2a46ab962e032 to < c462e15497dc40abe369b3be7a2c91ac5d1be6f9affectedb7fb4d78a6ade6026d9e5cf438c2a46ab962e032 to < b5f92cc4e24a298bf390b0b189a4b888c0900161affectedb7fb4d78a6ade6026d9e5cf438c2a46ab962e032 to < 6ad6954492697681ebcfc1beb0eb384406cd4b65affectedb7fb4d78a6ade6026d9e5cf438c2a46ab962e032 to < eadd0c2c76aee6a738f17f251434c77db3c606c8affectedb7fb4d78a6ade6026d9e5cf438c2a46ab962e032 to < d5b2752a17efc165793ae38f2c24b5ed9c04ffdeaffectedb7fb4d78a6ade6026d9e5cf438c2a46ab962e032 to < 81bbcff0c053c4f5c711c31a9b72fc492bd96c3faffected3ca8a07f141fd8eec347a82bdfa4b94164f2bb97affected3ba83e46b591381e718007f55c9f831fd0cd7ee8affected5.15.47 to < 5.15.212affected5.17.15 to < 5.18affected5.18.4 to < 5.19affected
Linux Linux
Default version status: affected
5.19affected0 to < 5.19unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/606cc45e871e34b80a2f63874f069387a5b44176 ↗
- https://git.kernel.org/stable/c/c462e15497dc40abe369b3be7a2c91ac5d1be6f9 ↗
- https://git.kernel.org/stable/c/b5f92cc4e24a298bf390b0b189a4b888c0900161 ↗
- https://git.kernel.org/stable/c/6ad6954492697681ebcfc1beb0eb384406cd4b65 ↗
- https://git.kernel.org/stable/c/eadd0c2c76aee6a738f17f251434c77db3c606c8 ↗
- https://git.kernel.org/stable/c/d5b2752a17efc165793ae38f2c24b5ed9c04ffde ↗
- https://git.kernel.org/stable/c/81bbcff0c053c4f5c711c31a9b72fc492bd96c3f ↗