Linux Kernel TW68 PCI Driver Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in the Linux kernel's TW68 PCI driver. This issue arises in the buffer preparation and finishing process. When the driver invokes the 'tw68_risc_buffer()' function to prepare the buffer, the 'dma_alloc_coherent' call may fail, leaving the buffer's CPU pointer empty. Consequently, accessing or freeing the buffer triggers a null pointer dereference. This vulnerability can potentially be exploited dynamically from the user side.

Impact

Exploitation of this vulnerability leads to a null pointer dereference, causing a kernel crash.

Reproduction

The vulnerability can be reproduced by using the TW68 PCI driver to capture video. During this process, the driver may attempt to allocate a buffer using 'dma_alloc_coherent'. If this allocation fails, the buffer will be left with an empty CPU pointer. Later, when the driver tries to access or free this buffer, a null pointer dereference occurs, crashing the kernel.

Remediation

The vulnerability has been addressed in the Linux kernel. Users can upgrade to the latest version to mitigate this issue.