Detection Guidance

This vulnerability manifests as a NULL pointer dereference in the Linux kernel related to the fastrpc rpmsg callback, which can cause kernel crashes at boot time.

Detection can be performed by monitoring kernel logs for messages indicating a NULL pointer dereference or kernel oops related to fastrpc_rpmsg_callback or spinlock failures.

Suggested commands to detect this issue include checking the kernel ring buffer for relevant errors:

• dmesg | grep -i 'fastrpc_rpmsg_callback'
• dmesg | grep -i 'NULL pointer dereference'
• journalctl -k | grep -i 'fastrpc'

Additionally, monitoring for kernel oops or panic messages during system boot can help identify if this vulnerability is triggered.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a NULL pointer dereference in the Linux kernel's fastrpc driver, specifically in the rpmsg callback function. It occurs when the DSP sends a glink message before the fastrpc_rpmsg_probe() function has completed initialization. This causes the callback to attempt to access a spinlock through a NULL pointer, leading to a kernel fault.

The root cause involves the order of initialization: dev_set_drvdata() is called before spin_lock_init() and idr_init(), creating a window where the callback can retrieve a pointer to an uninitialized structure or even a NULL pointer. Additionally, the rpmsg channel becomes active as soon as the driver is bound, so the callback can be triggered before dev_set_drvdata() is called, resulting in a NULL pointer dereference.

The fix involves moving all initialization of the context structure ahead of dev_set_drvdata() to ensure it is fully initialized before becoming visible to the callback, and adding a NULL check in the callback function as a safeguard.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Linux kernel to crash due to a NULL pointer dereference, leading to a kernel panic or system instability. This can result in denial of service, where the affected system becomes unresponsive or requires a reboot.

Useful 0 Not Useful 0

Mitigation Strategies

This vulnerability is caused by a NULL pointer dereference in the fastrpc rpmsg callback due to improper initialization order and lack of NULL checks.

Immediate mitigation steps include ensuring that the fastrpc_channel_ctx structure is fully initialized before it becomes visible to the callback. This means moving all context initialization ahead of dev_set_drvdata() so that the spinlock and idr are properly initialized before use.

Additionally, adding a NULL check in the fastrpc_rpmsg_callback() function acts as a guard against any remaining race conditions where the callback might be invoked before initialization completes.

Practically, this means updating the Linux kernel to a version where this fix is applied or applying the patch that reorders initialization and adds the NULL check.

Useful 0 Not Useful 0