CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6617 vulnerabilities reference this CWE, most recent first.
GHSA-2C46-3V56-P8MQ
Vulnerability from github – Published: 2022-05-13 01:24 – Updated: 2022-05-13 01:24The raw_release function in net/can/raw.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.
{
"affected": [],
"aliases": [
"CVE-2011-1748"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-05-09T22:55:00Z",
"severity": "MODERATE"
},
"details": "The raw_release function in net/can/raw.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.",
"id": "GHSA-2c46-3v56-p8mq",
"modified": "2022-05-13T01:24:48Z",
"published": "2022-05-13T01:24:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1748"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=698057"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=10022a6c66e199d8f61d9044543f38785713cbbd"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=10022a6c66e199d8f61d9044543f38785713cbbd"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/04/20/7"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/04/21/1"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/04/21/2"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/04/21/7"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/04/22/2"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/04/25/4"
},
{
"type": "WEB",
"url": "http://permalink.gmane.org/gmane.linux.network/192974"
},
{
"type": "WEB",
"url": "http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.39-rc6"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/47835"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2C4F-VGWR-82Q6
Vulnerability from github – Published: 2023-07-21 21:30 – Updated: 2024-04-04 06:18A missing allocation check in sftp server processing read requests may cause a NULL dereference on low-memory conditions. The malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which was not being checked for failure. This will likely crash the authenticated user's sftp server connection (if implemented as forking as recommended). For thread-based servers, this might also cause DoS for legitimate users.
Given this code is not in any released versions, no security releases have been issued.
{
"affected": [],
"aliases": [
"CVE-2023-3603"
],
"database_specific": {
"cwe_ids": [
"CWE-476",
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-21T20:15:16Z",
"severity": "MODERATE"
},
"details": "A missing allocation check in sftp server processing read requests may cause a NULL dereference on low-memory conditions. The malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which was not being checked for failure. This will likely crash the authenticated user\u0027s sftp server connection (if implemented as forking as recommended). For thread-based servers, this might also cause DoS for legitimate users.\n\nGiven this code is not in any released versions, no security releases have been issued.",
"id": "GHSA-2c4f-vgwr-82q6",
"modified": "2024-04-04T06:18:44Z",
"published": "2023-07-21T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3603"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-3603"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2221791"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-2C7P-HJRR-CXQ7
Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2025-04-20 03:37The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive.
{
"affected": [],
"aliases": [
"CVE-2017-8847"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-08T14:29:00Z",
"severity": "MODERATE"
},
"details": "The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive.",
"id": "GHSA-2c7p-hjrr-cxq7",
"modified": "2025-04-20T03:37:20Z",
"published": "2022-05-13T01:26:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8847"
},
{
"type": "WEB",
"url": "https://github.com/ckolivas/lrzip/issues/67"
},
{
"type": "WEB",
"url": "https://blogs.gentoo.org/ago/2017/05/07/lrzip-null-pointer-dereference-in-bufreadget-libzpaq-h"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202005-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2C7R-JXV5-347C
Vulnerability from github – Published: 2025-05-09 09:33 – Updated: 2025-11-12 21:31In the Linux kernel, the following vulnerability has been resolved:
s390/sclp: Add check for get_zeroed_page()
Add check for the return value of get_zeroed_page() in sclp_console_init() to prevent null pointer dereference. Furthermore, to solve the memory leak caused by the loop allocation, add a free helper to do the free job.
{
"affected": [],
"aliases": [
"CVE-2025-37883"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-09T07:16:09Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/sclp: Add check for get_zeroed_page()\n\nAdd check for the return value of get_zeroed_page() in\nsclp_console_init() to prevent null pointer dereference.\nFurthermore, to solve the memory leak caused by the loop\nallocation, add a free helper to do the free job.",
"id": "GHSA-2c7r-jxv5-347c",
"modified": "2025-11-12T21:31:03Z",
"published": "2025-05-09T09:33:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37883"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/28e5a867aa542e369e211c2baba7044228809a99"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/397254706eba9d8f99fd237feede7ab3169a7f9a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3b3aa72636a6205933609ec274a8747720c1ee3f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3db42c75a921854a99db0a2775814fef97415bac"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e1e00dc45648125ef7cb87ebc3b581ac224e7b39"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f69f8a93aacf6e99af7b1cc992d8ca2cc07b96fb"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2C9Q-JGX6-2QX7
Vulnerability from github – Published: 2024-04-23 09:30 – Updated: 2024-07-03 18:36QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval.
{
"affected": [],
"aliases": [
"CVE-2023-48183"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-23T07:15:42Z",
"severity": "HIGH"
},
"details": "QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of \"this\" with eval.",
"id": "GHSA-2c9q-jgx6-2qx7",
"modified": "2024-07-03T18:36:36Z",
"published": "2024-04-23T09:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48183"
},
{
"type": "WEB",
"url": "https://github.com/bellard/quickjs/issues/192"
},
{
"type": "WEB",
"url": "https://github.com/bellard/quickjs/commit/c4cdd61a3ed284cd760faf6b00bbf0cb908da077"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2CFF-2PFQ-X5V9
Vulnerability from github – Published: 2022-05-14 01:20 – Updated: 2022-05-14 01:20poppler 0.54.0, as used in Evince and other products, has a NULL pointer dereference in the JPXStream::readUByte function in JPXStream.cc. For example, the perf_test utility will crash (segmentation fault) when parsing an invalid PDF file.
{
"affected": [],
"aliases": [
"CVE-2017-9083"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-19T16:29:00Z",
"severity": "MODERATE"
},
"details": "poppler 0.54.0, as used in Evince and other products, has a NULL pointer dereference in the JPXStream::readUByte function in JPXStream.cc. For example, the perf_test utility will crash (segmentation fault) when parsing an invalid PDF file.",
"id": "GHSA-2cff-2pfq-x5v9",
"modified": "2022-05-14T01:20:24Z",
"published": "2022-05-14T01:20:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9083"
},
{
"type": "WEB",
"url": "https://bugs.freedesktop.org/show_bug.cgi?id=101084"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201801-17"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2CJ3-6XFH-2WMC
Vulnerability from github – Published: 2024-07-12 15:31 – Updated: 2024-09-09 18:30In the Linux kernel, the following vulnerability has been resolved:
ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
The ssb_device_uevent() function first attempts to convert the 'dev' pointer to 'struct ssb_device *'. However, it mistakenly dereferences 'dev' before performing the NULL check, potentially leading to a NULL pointer dereference if 'dev' is NULL.
To fix this issue, move the NULL check before dereferencing the 'dev' pointer, ensuring that the pointer is valid before attempting to use it.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
{
"affected": [],
"aliases": [
"CVE-2024-40982"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-12T13:15:19Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nssb: Fix potential NULL pointer dereference in ssb_device_uevent()\n\nThe ssb_device_uevent() function first attempts to convert the \u0027dev\u0027 pointer\nto \u0027struct ssb_device *\u0027. However, it mistakenly dereferences \u0027dev\u0027 before\nperforming the NULL check, potentially leading to a NULL pointer\ndereference if \u0027dev\u0027 is NULL.\n\nTo fix this issue, move the NULL check before dereferencing the \u0027dev\u0027 pointer,\nensuring that the pointer is valid before attempting to use it.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
"id": "GHSA-2cj3-6xfh-2wmc",
"modified": "2024-09-09T18:30:29Z",
"published": "2024-07-12T15:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40982"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/789c17185fb0f39560496c2beab9b57ce1d0cbe7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7d43c8377c6fc846b1812f8df360425c9323dc56"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c5dc2d8eb3981bae261ea7d1060a80868e886813"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2CMP-5J27-VPM7
Vulnerability from github – Published: 2024-09-03 03:30 – Updated: 2024-09-03 03:30A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V5.20 through V5.38, and USG20(W)-VPN series firmware versions from V5.20 through V5.38 could allow an unauthenticated attacker to cause DoS conditions by sending crafted packets to a vulnerable device.
{
"affected": [],
"aliases": [
"CVE-2024-42058"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-03T02:15:04Z",
"severity": "HIGH"
},
"details": "A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V5.20 through V5.38, and USG20(W)-VPN series firmware versions from V5.20 through V5.38 could allow an unauthenticated attacker to cause DoS conditions by sending crafted packets to a vulnerable device.",
"id": "GHSA-2cmp-5j27-vpm7",
"modified": "2024-09-03T03:30:35Z",
"published": "2024-09-03T03:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42058"
},
{
"type": "WEB",
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2CQH-7J4M-CJVM
Vulnerability from github – Published: 2022-05-13 01:04 – Updated: 2025-04-12 12:59The aiptek_probe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device that lacks endpoints.
{
"affected": [],
"aliases": [
"CVE-2015-7515"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-04-27T17:59:00Z",
"severity": "MODERATE"
},
"details": "The aiptek_probe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device that lacks endpoints.",
"id": "GHSA-2cqh-7j4m-cjvm",
"modified": "2025-04-12T12:59:14Z",
"published": "2022-05-13T01:04:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7515"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/8e20cf2bce122ce9262d6034ee5d5b76fbb92f96"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1285326"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2015-7515"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/39544"
},
{
"type": "WEB",
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8e20cf2bce122ce9262d6034ee5d5b76fbb92f96"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3607"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/84288"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2967-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2967-2"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2968-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2968-2"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2969-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2970-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2971-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2971-2"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2971-3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2CRH-849Q-GG8V
Vulnerability from github – Published: 2022-03-05 00:00 – Updated: 2022-03-17 00:03Null pointer dereference in the htmldoc v1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service via a crafted html file.
{
"affected": [],
"aliases": [
"CVE-2021-26948"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-03T23:15:00Z",
"severity": "HIGH"
},
"details": "Null pointer dereference in the htmldoc v1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service via a crafted html file.",
"id": "GHSA-2crh-849q-gg8v",
"modified": "2022-03-17T00:03:35Z",
"published": "2022-03-05T00:00:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26948"
},
{
"type": "WEB",
"url": "https://github.com/michaelrsweet/htmldoc/issues/410"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.