CVE-2021-38208 — NULL Pointer Dereference in Kernel

CWE-476 — NULL Pointer Dereference CWE-665 — Improper Initialization12 documents8 sources

Severity

5.5MEDIUMNVD

OSV7.8OSV4.2

EPSS

0.1%

top 75.91%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Linux Kernel Debian Linux Msrc Cbl2 Kernel 5.10.78.1-1 ON CBL Mariner 2.0 +1 more

Timeline

PublishedAug 8

Latest updateSep 26

Description

net/nfc/llcp_sock.c in the Linux kernel before 5.12.10 allows local unprivileged users to cause a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages6 packages

▶NVDlinux/linux_kernel< 5.12.10

▶Debianlinux/linux_kernel< 5.10.46-1+3

▶Ubuntulinux/linux_kernel< 4.4.0-222.255

▶debiandebian/linux< linux 5.10.46-1 (bookworm)

▶msrcmsrc/cm1_kernel_5.10.60.1-1_on_cbl_mariner_1.0

Patches

Patch: bugzilla.redhat.com ↗Patch: cdn.kernel.org ↗Patch: github.com ↗

🔴Vulnerability Details

GHSA

GHSA-f32x-jvjj-mwj4: net/nfc/llcp_sock↗2022-05-24

▶

OSV

linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities↗2022-03-22

▶

OSV

linux-aws-5.8, linux-azure-5.8, linux-gcp-5.8, linux-oracle-5.8 vulnerabilities↗2021-08-24

▶

OSV

CVE-2021-38208: net/nfc/llcp_sock↗2021-08-08

▶

📋Vendor Advisories

Ubuntu

Linux kernel vulnerabilities↗2022-03-22

▶

Ubuntu

Linux kernel vulnerabilities↗2021-08-24

▶

Microsoft

▶

Red Hat

kernel: nfc: Null pointer dereference in llcp_sock_getname↗2021-06-01

▶

Red Hat

kernel: NULL pointer dereference in net/nfc/llcp_sock.c by making a getsockname call after a certain type of failure of a bind call↗2021-05-31

▶

📄Research Papers

arXiv

Timeloops: Automatic System Call Policy Learning for Containerized Microservices↗2022-09-26

▶