CVE-2021-38200: Null Pointer Dereference
arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perfeventparanoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service (perfinstructionpointer NULL pointer dereference and OOPS) via a "perf record" command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.12.13 - Compensating control
Set perf_event_paranoid to a value other than -1 (so perf_event_paranoid != -1), reducing local users' ability to trigger the perf record-related NULL pointer dereference/OOPS on kernels before 5.12.13.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-38200?
CVE-2021-38200 has a high severity level as it allows local users to cause a denial of service through a NULL pointer dereference.
How do I fix CVE-2021-38200?
To fix CVE-2021-38200, update the Linux kernel to version 5.12.13 or newer.
Which versions of the Linux kernel are affected by CVE-2021-38200?
CVE-2021-38200 affects Linux kernel versions prior to 5.12.13.
Can CVE-2021-38200 be exploited remotely?
CVE-2021-38200 cannot be exploited remotely as it requires local user access.
What command can trigger the CVE-2021-38200 vulnerability?
The vulnerability can be triggered using the "perf record" command under certain conditions.