NULL Pointer Dereference Affecting kernel-doc package, versions <0:4.18.0-372.9.1.el8
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL8-KERNELDOC-8165911
- published 8 Oct 2024
- disclosed 24 May 2024
Introduced: 24 May 2024
CVE-2021-47556 Open this link in a new tabHow to fix?
Upgrade RHEL:8 kernel-doc to version 0:4.18.0-372.9.1.el8 or higher.
This issue was patched in RHSA-2022:1988.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-doc package and not the kernel-doc package as distributed by RHEL.
See How to fix? for RHEL:8 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
ethtool_set_coalesce() now uses both the .get_coalesce() and .set_coalesce() callbacks. But the check for their availability is buggy, so changing the coalesce settings on a device where the driver provides only one of the callbacks results in a NULL pointer dereference instead of an -EOPNOTSUPP.
Fix the condition so that the availability of both callbacks is ensured. This also matches the netlink code.
Note that reproducing this requires some effort - it only affects the legacy ioctl path, and needs a specific combination of driver options:
- have .get_coalesce() and .coalesce_supported but no .set_coalesce(), or
- have .set_coalesce() but no .get_coalesce(). Here eg. ethtool doesn't cause the crash as it first attempts to call ethtool_get_coalesce() and bails out on error.