CVE-2024-46856

In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83822: Fix NULL pointer dereference on DP83825 devices The probe() function is only used for DP83822 and DP83826 PHY, leaving the private data pointer uninitialized for the DP83825 models which causes a NULL pointer dereference in the recently introduced/changed functions dp8382x_config_init() and dp83822_set_wol(). Add the dp8382x_probe() function, so all PHY models will have a valid private data pointer to fix this issue and also prevent similar issues in the future.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/3f62ea572b3e8e3f10c39a9cb4f04ca9ae5f2952	Patch
https://git.kernel.org/stable/c/67b61e2f4c9c5df97a9a2ef7a1fe35eae00531f4	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.11:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.11:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.11:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.11:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.11:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.11:rc6::::::
	cpe:2.3:o:linux:linux_kernel:6.11:rc7::::::

History

01 Oct 2024, 16:04

Type	Values Removed	Values Added
First Time		Linux linux Kernel Linux
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
References	~~() https://git.kernel.org/stable/c/3f62ea572b3e8e3f10c39a9cb4f04ca9ae5f2952 -~~	() https://git.kernel.org/stable/c/3f62ea572b3e8e3f10c39a9cb4f04ca9ae5f2952 - Patch
References	~~() https://git.kernel.org/stable/c/67b61e2f4c9c5df97a9a2ef7a1fe35eae00531f4 -~~	() https://git.kernel.org/stable/c/67b61e2f4c9c5df97a9a2ef7a1fe35eae00531f4 - Patch
CWE		CWE-476
CPE		cpe:2.3:o:linux:linux_kernel:6.11:rc6:::::: cpe:2.3:o:linux:linux_kernel:6.11:rc7:::::: cpe:2.3:o:linux:linux_kernel:6.11:rc5:::::: cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:6.11:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.11:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.11:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.11:rc3::::::

30 Sep 2024, 12:45

Type	Values Removed	Values Added
Summary		(es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: phy: dp83822: Se corrige la desreferencia del puntero NULL en los dispositivos DP83825 La función probe() solo se usa para DP83822 y DP83826 PHY, lo que deja el puntero de datos privados sin inicializar para los modelos DP83825, lo que provoca una desreferencia del puntero NULL en las funciones recientemente introducidas/cambiadas dp8382x_config_init() y dp83822_set_wol(). Agregue la función dp8382x_probe(), para que todos los modelos PHY tengan un puntero de datos privados válido para solucionar este problema y también evitar problemas similares en el futuro.

27 Sep 2024, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-27 13:15

Updated : 2024-10-01 16:04

NVD link : CVE-2024-46856

Mitre link : CVE-2024-46856

CVE.ORG link : CVE-2024-46856

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-476

NULL Pointer Dereference

5.5 /10