CVE-2024-35883

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35883

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe In function pci1xxxx_spi_probe, there is a potential null pointer that may be caused by a failed memory allocation by the function devm_kzalloc. Hence, a null pointer check needs to be added to prevent null pointer dereferencing later in the code. To fix this issue, spi_bus->spi_int[iter] should be checked. The memory allocated by devm_kzalloc will be automatically released, so just directly return -ENOMEM without worrying about memory leaks.

References
Link Resource
https://git.kernel.org/stable/c/1f886a7bfb3faf4c1021e73f045538008ce7634e Patch
https://git.kernel.org/stable/c/4b31a226097cf8cc3c9de5e855d97757fdb2bf06 Patch
https://git.kernel.org/stable/c/95e5d9eb26705a9a76d2ef8bcba9ee2e195d653d Patch
https://git.kernel.org/stable/c/1f886a7bfb3faf4c1021e73f045538008ce7634e Patch
https://git.kernel.org/stable/c/4b31a226097cf8cc3c9de5e855d97757fdb2bf06 Patch
https://git.kernel.org/stable/c/95e5d9eb26705a9a76d2ef8bcba9ee2e195d653d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
History

07 Jan 2025, 17:03

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1f886a7bfb3faf4c1021e73f045538008ce7634e - () https://git.kernel.org/stable/c/1f886a7bfb3faf4c1021e73f045538008ce7634e - Patch
References () https://git.kernel.org/stable/c/4b31a226097cf8cc3c9de5e855d97757fdb2bf06 - () https://git.kernel.org/stable/c/4b31a226097cf8cc3c9de5e855d97757fdb2bf06 - Patch
References () https://git.kernel.org/stable/c/95e5d9eb26705a9a76d2ef8bcba9ee2e195d653d - () https://git.kernel.org/stable/c/95e5d9eb26705a9a76d2ef8bcba9ee2e195d653d - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
First Time Linux linux Kernel
Linux

21 Nov 2024, 09:21

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi: mchp-pci1xxx: corrige una posible desreferencia de puntero null en pci1xxx_spi_probe En la función pci1xxxx_spi_probe, existe un posible puntero null que puede deberse a una asignación de memoria fallida por parte de la función devm_kzalloc. Por lo tanto, es necesario agregar una verificación de puntero null para evitar que se elimine la referencia al puntero null más adelante en el código. Para solucionar este problema, se debe marcar spi_bus->spi_int[iter]. La memoria asignada por devm_kzalloc se liberará automáticamente, por lo que simplemente devuelva -ENOMEM directamente sin preocuparse por pérdidas de memoria.
References () https://git.kernel.org/stable/c/1f886a7bfb3faf4c1021e73f045538008ce7634e - () https://git.kernel.org/stable/c/1f886a7bfb3faf4c1021e73f045538008ce7634e -
References () https://git.kernel.org/stable/c/4b31a226097cf8cc3c9de5e855d97757fdb2bf06 - () https://git.kernel.org/stable/c/4b31a226097cf8cc3c9de5e855d97757fdb2bf06 -
References () https://git.kernel.org/stable/c/95e5d9eb26705a9a76d2ef8bcba9ee2e195d653d - () https://git.kernel.org/stable/c/95e5d9eb26705a9a76d2ef8bcba9ee2e195d653d -

19 May 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-19 09:15

Updated : 2025-01-07 17:03

NVD link : CVE-2024-35883

Mitre link : CVE-2024-35883

CVE.ORG link : CVE-2024-35883

JSON object : View

Products Affected

linux

CWE
CWE-476

NULL Pointer Dereference