CVE-2021-47631

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
26/02/2025
Last modified:
01/10/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ARM: davinci: da850-evm: Avoid NULL pointer dereference<br /> <br /> With newer versions of GCC, there is a panic in da850_evm_config_emac()<br /> when booting multi_v5_defconfig in QEMU under the palmetto-bmc machine:<br /> <br /> Unable to handle kernel NULL pointer dereference at virtual address 00000020<br /> pgd = (ptrval)<br /> [00000020] *pgd=00000000<br /> Internal error: Oops: 5 [#1] PREEMPT ARM<br /> Modules linked in:<br /> CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1<br /> Hardware name: Generic DT based system<br /> PC is at da850_evm_config_emac+0x1c/0x120<br /> LR is at do_one_initcall+0x50/0x1e0<br /> <br /> The emac_pdata pointer in soc_info is NULL because davinci_soc_info only<br /> gets populated on davinci machines but da850_evm_config_emac() is called<br /> on all machines via device_initcall().<br /> <br /> Move the rmii_en assignment below the machine check so that it is only<br /> dereferenced when running on a supported SoC.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 2.6.33 (including) 4.9.311 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.10 (including) 4.14.276 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.15 (including) 4.19.239 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.20 (including) 5.4.190 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.112 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.35 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 5.17.4 (excluding)
cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.18:rc2:*:*:*:*:*:*