CVE-2021-47631
ARM Davinci Linux Kernel NULL Pointer Dereference Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: ARM: davinci: da850-evm: Avoid NULL pointer dereference With newer versions of GCC, there is a panic in da850_evm_config_emac() when booting multi_v5_defconfig in QEMU under the palmetto-bmc machine: Unable to handle kernel NULL pointer dereference at virtual address 00000020 pgd = (ptrval) [00000020] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT ARM Modules linked in: CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1 Hardware name: Generic DT based system PC is at da850_evm_config_emac+0x1c/0x120 LR is at do_one_initcall+0x50/0x1e0 The emac_pdata pointer in soc_info is NULL because davinci_soc_info only gets populated on davinci machines but da850_evm_config_emac() is called on all machines via device_initcall(). Move the rmii_en assignment below the machine check so that it is only dereferenced when running on a supported SoC.
INFO
Published Date :
Feb. 26, 2025, 6:37 a.m.
Last Modified :
March 18, 2025, 7:35 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2021-47631.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2021-47631 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2021-47631 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Mar. 18, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.18:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 5.17.4 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.35 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.190 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 up to (excluding) 4.19.239 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.33 up to (excluding) 4.9.311 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.10 up to (excluding) 4.14.276 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.112 Added Reference Type kernel.org: https://git.kernel.org/stable/c/0940795c6834fbe7705acc5c3d4b2f7a5f67527a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/0a312ec66a03133d28570f07bc52749ccfef54da Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/83a1cde5c74bfb44b49cb2a940d044bb2380f4ea Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/89931d4762572aaee6edbe5673d41f8082de110f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a12b356d45cbb6e8a1b718d1436b3d6239a862f3 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c06f476e5b74bcabb8c4a2fba55864a37e62843b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c5628533a3ece64235d04fe11ec44d2be99e423d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c64e2ed5cc376e137e572babfd2edc38b2cfb61b Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Feb. 26, 2025
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: ARM: davinci: da850-evm: Avoid NULL pointer dereference With newer versions of GCC, there is a panic in da850_evm_config_emac() when booting multi_v5_defconfig in QEMU under the palmetto-bmc machine: Unable to handle kernel NULL pointer dereference at virtual address 00000020 pgd = (ptrval) [00000020] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT ARM Modules linked in: CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1 Hardware name: Generic DT based system PC is at da850_evm_config_emac+0x1c/0x120 LR is at do_one_initcall+0x50/0x1e0 The emac_pdata pointer in soc_info is NULL because davinci_soc_info only gets populated on davinci machines but da850_evm_config_emac() is called on all machines via device_initcall(). Move the rmii_en assignment below the machine check so that it is only dereferenced when running on a supported SoC. Added Reference https://git.kernel.org/stable/c/0940795c6834fbe7705acc5c3d4b2f7a5f67527a Added Reference https://git.kernel.org/stable/c/0a312ec66a03133d28570f07bc52749ccfef54da Added Reference https://git.kernel.org/stable/c/83a1cde5c74bfb44b49cb2a940d044bb2380f4ea Added Reference https://git.kernel.org/stable/c/89931d4762572aaee6edbe5673d41f8082de110f Added Reference https://git.kernel.org/stable/c/a12b356d45cbb6e8a1b718d1436b3d6239a862f3 Added Reference https://git.kernel.org/stable/c/c06f476e5b74bcabb8c4a2fba55864a37e62843b Added Reference https://git.kernel.org/stable/c/c5628533a3ece64235d04fe11ec44d2be99e423d Added Reference https://git.kernel.org/stable/c/c64e2ed5cc376e137e572babfd2edc38b2cfb61b
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2021-47631 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2021-47631
weaknesses.