linux-cve-announce - CVE-2021-47333: misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024052135-CVE-2021-47333-ed1e@gregkh>
Date: Tue, 21 May 2024 16:36:07 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2021-47333: misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge

There is an issue with the ASPM(optional) capability checking function.
A device might be attached to root complex directly, in this case,
bus->self(bridge) will be NULL, thus priv->parent_pdev is NULL.
Since alcor_pci_init_check_aspm(priv->parent_pdev) checks the PCI link's
ASPM capability and populate parent_cap_off, which will be used later by
alcor_pci_aspm_ctrl() to dynamically turn on/off device, what we can do
here is to avoid checking the capability if we are on the root complex.
This will make pdev_cap_off 0 and alcor_pci_aspm_ctrl() will simply
return when bring called, effectively disable ASPM for the device.

[    1.246492] BUG: kernel NULL pointer dereference, address: 00000000000000c0
[    1.248731] RIP: 0010:pci_read_config_byte+0x5/0x40
[    1.253998] Call Trace:
[    1.254131]  ? alcor_pci_find_cap_offset.isra.0+0x3a/0x100 [alcor_pci]
[    1.254476]  alcor_pci_probe+0x169/0x2d5 [alcor_pci]

The Linux kernel CVE team has assigned CVE-2021-47333 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.4.134 with commit d2639ffdcad4
	Fixed in 5.10.52 with commit 58f69684ba03
	Fixed in 5.12.19 with commit 717cf5ae5232
	Fixed in 5.13.4 with commit 09d154990ca8
	Fixed in 5.14 with commit 3ce3e45cc333

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47333
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/misc/cardreader/alcor_pci.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d2639ffdcad463b358b6bef8645ff81715daffcb
	https://git.kernel.org/stable/c/58f69684ba03e5b0e0a3ae844a845280c0f06309
	https://git.kernel.org/stable/c/717cf5ae52322ddbdf3ac2c584b34c5970b0d174
	https://git.kernel.org/stable/c/09d154990ca82d14aed2b72796f6c8845e2e605d
	https://git.kernel.org/stable/c/3ce3e45cc333da707d4d6eb433574b990bcc26f5