Nathan Chancellor

A NULL pointer dereference issue has been identified in the Linux kernel, specifically in the da850-evm configuration for the ARM architecture. This issue occurs when booting with newer versions of GCC, resulting in a kernel panic. The problem arises because the emac pdata pointer in soc info is NULL, as davinci soc info only gets populated on davinci machines, but da850 evm config emac() is called on all machines. The error manifests as an "Unable to handle kernel NULL pointer dereference" message.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the nl80211 component of the Linux kernel, where address calculations via out of bounds array indexing can occur. Before `request->channels[]` can be used, `request->n channels` must be set. Additionally, address calculations for memory after the "channels" array need to be calculated from the allocation base ("request") rather than via the first "out of bounds" index of "channels", otherwise run-time bounds checking will throw a warning. This vulnerability may allow an attacker to cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The vulnerability is related to the incorrect byte-swapping of NOP instructions when compiling for big-endian architectures using LLVM's integrated assembler prior to version 15.0.0. This could result in the corruption of user or kernel FPSIMD state. The issue was unnoticed until a commit was made to use a positive cpucap for FP/SIMD, after which the instructions would trap during boot prior to FPSIMD being detected and enabled.

A vulnerability in the Linux kernel has been resolved, related to the interaction between wait for device probe() and deferred probe timeout. The issue caused mounting NFS rootfs to time out when deferred probe timeout was non-zero. This was due to ip auto config() initcall timing out while waiting for network interfaces to appear. Although a commit tried to fix this by making wait for device probe() wait for deferred probe timeout to expire, it introduced a deadlock or blocked kernel init() from continuing until the timeout expired. The changes to wait for device probe() were reverted to resolve the issue.