| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-47631: ARM: davinci: da850-evm: Avoid NULL pointer dereference |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ARM: davinci: da850-evm: Avoid NULL pointer dereference |
| |
| With newer versions of GCC, there is a panic in da850_evm_config_emac() |
| when booting multi_v5_defconfig in QEMU under the palmetto-bmc machine: |
| |
| Unable to handle kernel NULL pointer dereference at virtual address 00000020 |
| pgd = (ptrval) |
| [00000020] *pgd=00000000 |
| Internal error: Oops: 5 [#1] PREEMPT ARM |
| Modules linked in: |
| CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1 |
| Hardware name: Generic DT based system |
| PC is at da850_evm_config_emac+0x1c/0x120 |
| LR is at do_one_initcall+0x50/0x1e0 |
| |
| The emac_pdata pointer in soc_info is NULL because davinci_soc_info only |
| gets populated on davinci machines but da850_evm_config_emac() is called |
| on all machines via device_initcall(). |
| |
| Move the rmii_en assignment below the machine check so that it is only |
| dereferenced when running on a supported SoC. |
| |
| The Linux kernel CVE team has assigned CVE-2021-47631 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 2.6.33 with commit bae105879f2f2404155da6f50b3636193d228a62 and fixed in 4.9.311 with commit c06f476e5b74bcabb8c4a2fba55864a37e62843b |
| Issue introduced in 2.6.33 with commit bae105879f2f2404155da6f50b3636193d228a62 and fixed in 4.14.276 with commit a12b356d45cbb6e8a1b718d1436b3d6239a862f3 |
| Issue introduced in 2.6.33 with commit bae105879f2f2404155da6f50b3636193d228a62 and fixed in 4.19.239 with commit c64e2ed5cc376e137e572babfd2edc38b2cfb61b |
| Issue introduced in 2.6.33 with commit bae105879f2f2404155da6f50b3636193d228a62 and fixed in 5.4.190 with commit 89931d4762572aaee6edbe5673d41f8082de110f |
| Issue introduced in 2.6.33 with commit bae105879f2f2404155da6f50b3636193d228a62 and fixed in 5.10.112 with commit 0a312ec66a03133d28570f07bc52749ccfef54da |
| Issue introduced in 2.6.33 with commit bae105879f2f2404155da6f50b3636193d228a62 and fixed in 5.15.35 with commit 0940795c6834fbe7705acc5c3d4b2f7a5f67527a |
| Issue introduced in 2.6.33 with commit bae105879f2f2404155da6f50b3636193d228a62 and fixed in 5.17.4 with commit c5628533a3ece64235d04fe11ec44d2be99e423d |
| Issue introduced in 2.6.33 with commit bae105879f2f2404155da6f50b3636193d228a62 and fixed in 5.18 with commit 83a1cde5c74bfb44b49cb2a940d044bb2380f4ea |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-47631 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| arch/arm/mach-davinci/board-da850-evm.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/c06f476e5b74bcabb8c4a2fba55864a37e62843b |
| https://git.kernel.org/stable/c/a12b356d45cbb6e8a1b718d1436b3d6239a862f3 |
| https://git.kernel.org/stable/c/c64e2ed5cc376e137e572babfd2edc38b2cfb61b |
| https://git.kernel.org/stable/c/89931d4762572aaee6edbe5673d41f8082de110f |
| https://git.kernel.org/stable/c/0a312ec66a03133d28570f07bc52749ccfef54da |
| https://git.kernel.org/stable/c/0940795c6834fbe7705acc5c3d4b2f7a5f67527a |
| https://git.kernel.org/stable/c/c5628533a3ece64235d04fe11ec44d2be99e423d |
| https://git.kernel.org/stable/c/83a1cde5c74bfb44b49cb2a940d044bb2380f4ea |
