Linux Kernel NULL Pointer Dereference Vulnerability in rpmsg Qualcomm Glink Driver

A vulnerability in the Linux kernel's rpmsg Qualcomm Glink driver can lead to a NULL pointer dereference. This issue arises because the driver does not properly check the return value of the kstrdup() function, which can result in a memory allocation failure being ignored. The vulnerability has been addressed by adding a check for the kstrdup() return value and handling errors appropriately. The fix is available in the Linux kernel stable tree.

Impact

Exploitation of this vulnerability can cause a NULL pointer dereference, leading to a system crash.

Reproduction

The vulnerability can be reproduced by loading the rpmsg Qualcomm Glink driver and triggering the channel allocation function, qcom_glink_alloc_channel. If the kstrdup() function fails to allocate memory, the error is not handled, causing a NULL pointer dereference when the driver attempts to use the allocated memory.

Remediation

Users can upgrade to the latest version of the Linux kernel stable tree, where this vulnerability has been fixed.