NULL Pointer Dereference in Linux Kernel IIO ADMV1013 Driver

Executive Summary

This vulnerability occurs in the Linux kernel's iio frequency admv1013 driver. When the function device_property_read_string() fails, a string variable (str) remains uninitialized. However, the code continues and calls strcmp(str, ...), which dereferences this uninitialized (garbage) pointer, leading to a NULL pointer dereference.

The fix involved replacing the manual read and strcmp operations with device_property_match_property_string(), and consolidating the SE mode enums into a single sequential enum that maps to hardware register values via a switch statement, consistent with other bitfields in the driver.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a NULL pointer dereference in the Linux kernel driver, which may lead to a kernel crash or system instability when the affected driver is used. This could result in denial of service or unexpected behavior on systems running the vulnerable driver.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the admv1013 driver NULL pointer dereference issue.

The fix involves replacing manual read/strcmp calls with device_property_match_property_string() and consolidating SE mode enums, so applying the relevant patches or upgrading to a patched kernel version is necessary.

Since several cleanup patches have been applied recently, manual backporting may be required if you are using an older kernel version.

Useful 0 Not Useful 0