CVE-2024-43860

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-43860
In the Linux kernel, the following vulnerability has been resolved: remoteproc: imx_rproc: Skip over memory region when node value is NULL In imx_rproc_addr_init() "nph = of_count_phandle_with_args()" just counts number of phandles. But phandles may be empty. So of_parse_phandle() in the parsing loop (0 < a < nph) may return NULL which is later dereferenced. Adjust this issue by adding NULL-return check. Found by Linux Verification Center (linuxtesting.org) with SVACE. [Fixed title to fit within the prescribed 70-75 charcters]

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2fa26ca8b786888673689ccc9da6094150939982 Patch
https://git.kernel.org/stable/c/4e13b7c23988c0a13fdca92e94296a3bc2ff9f21 Patch
https://git.kernel.org/stable/c/6884fd0283e0831be153fb8d82d9eda8a55acaaa Patch
https://git.kernel.org/stable/c/6b50462b473fdccdc0dfad73001147e40ff19a66 Patch
https://git.kernel.org/stable/c/6c9ea3547fad252fe9ae5d3ed7e066e2085bf3a2 Patch
https://git.kernel.org/stable/c/84beb7738459cac0ff9f8a7c4654b8ff82a702c0 Patch
https://git.kernel.org/stable/c/9a17cf8b2ce483fa75258bc2cdcf628f24bcf5f8 Patch
https://git.kernel.org/stable/c/c877a5f5268d4ab8224b9c9fbce3d746e4e72bc9 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

22 Aug 2024, 17:08

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CWE CWE-476
References () https://git.kernel.org/stable/c/2fa26ca8b786888673689ccc9da6094150939982 - () https://git.kernel.org/stable/c/2fa26ca8b786888673689ccc9da6094150939982 - Patch
References () https://git.kernel.org/stable/c/4e13b7c23988c0a13fdca92e94296a3bc2ff9f21 - () https://git.kernel.org/stable/c/4e13b7c23988c0a13fdca92e94296a3bc2ff9f21 - Patch
References () https://git.kernel.org/stable/c/6884fd0283e0831be153fb8d82d9eda8a55acaaa - () https://git.kernel.org/stable/c/6884fd0283e0831be153fb8d82d9eda8a55acaaa - Patch
References () https://git.kernel.org/stable/c/6b50462b473fdccdc0dfad73001147e40ff19a66 - () https://git.kernel.org/stable/c/6b50462b473fdccdc0dfad73001147e40ff19a66 - Patch
References () https://git.kernel.org/stable/c/6c9ea3547fad252fe9ae5d3ed7e066e2085bf3a2 - () https://git.kernel.org/stable/c/6c9ea3547fad252fe9ae5d3ed7e066e2085bf3a2 - Patch
References () https://git.kernel.org/stable/c/84beb7738459cac0ff9f8a7c4654b8ff82a702c0 - () https://git.kernel.org/stable/c/84beb7738459cac0ff9f8a7c4654b8ff82a702c0 - Patch
References () https://git.kernel.org/stable/c/9a17cf8b2ce483fa75258bc2cdcf628f24bcf5f8 - () https://git.kernel.org/stable/c/9a17cf8b2ce483fa75258bc2cdcf628f24bcf5f8 - Patch
References () https://git.kernel.org/stable/c/c877a5f5268d4ab8224b9c9fbce3d746e4e72bc9 - () https://git.kernel.org/stable/c/c877a5f5268d4ab8224b9c9fbce3d746e4e72bc9 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

19 Aug 2024, 12:59

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: remoteproc: imx_rproc: omitir la región de memoria cuando el valor del nodo es NULL En imx_rproc_addr_init() "nph = of_count_phandle_with_args()" solo cuenta el número de phandles. Pero los phandles pueden estar vacíos. Por lo tanto, of_parse_phandle() en el bucle de análisis (0 &lt; a &lt; nph) puede devolver NULL, que luego se desreferencia. Ajuste este problema agregando una verificación de retorno NULL. Encontrado por el Centro de verificación de Linux (linuxtesting.org) con SVACE. [Título fijo para que se ajuste a los 70-75 caracteres prescritos]

19 Aug 2024, 05:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/4e13b7c23988c0a13fdca92e94296a3bc2ff9f21 -
  • () https://git.kernel.org/stable/c/6884fd0283e0831be153fb8d82d9eda8a55acaaa -
  • () https://git.kernel.org/stable/c/6b50462b473fdccdc0dfad73001147e40ff19a66 -
  • () https://git.kernel.org/stable/c/84beb7738459cac0ff9f8a7c4654b8ff82a702c0 -

17 Aug 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-17 10:15

Updated : 2024-08-22 17:08

NVD link : CVE-2024-43860

Mitre link : CVE-2024-43860

CVE.ORG link : CVE-2024-43860

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference