CVE-2024-36893

CVE Details

Release Date:

2024-05-30

Description

In the Linux kernel, the following vulnerability has been resolved:\nusb: typec: tcpm: Check for port partner validity before consuming it\ntypec_register_partner() does not guarantee partner registration\nto always succeed. In the event of failure, port->partner is set\nto the error value or NULL. Given that port->partner validity is\nnot checked, this results in the following crash:\nUnable to handle kernel NULL pointer dereference at virtual address xx\npc : run_state_machine+0x1bc8/0x1c08\nlr : run_state_machine+0x1b90/0x1c08\n..\nCall trace:\nrun_state_machine+0x1bc8/0x1c08\ntcpm_state_machine_work+0x94/0xe4\nkthread_worker_fn+0x118/0x328\nkthread+0x1d0/0x23c\nret_from_fork+0x10/0x20\nTo prevent the crash, check for port->partner validity before\nderefencing it in all the call sites.

See more information about CVE-2024-36893 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	4.4
Vector String:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	High
User Interaction:	None
Scope:	Unchanged
Confidentiality:	None
Integrity:	None
Availability:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12887	2024-12-18
Oracle Linux version 9 (kernel-uek)	ELSA-2024-12887	2024-12-18