CVE-2024-36930

CVE Details

Release Date:	2024-05-30
Impact:	Moderate	What is this?

Description

In the Linux kernel, the following vulnerability has been resolved:\nspi: fix null pointer dereference within spi_sync\nIf spi_sync() is called with the non-empty queue and the same spi_message\nis then reused, the complete callback for the message remains set while\nthe context is cleared, leading to a null pointer dereference when the\ncallback is invoked from spi_finalize_current_message().\nWith function inlining disabled, the call stack might look like this:\n_raw_spin_lock_irqsave from complete_with_flags+0x18/0x58\ncomplete_with_flags from spi_complete+0x8/0xc\nspi_complete from spi_finalize_current_message+0xec/0x184\nspi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474\nspi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230\n__spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4\n__spi_transfer_message_noqueue from __spi_sync+0x204/0x248\n__spi_sync from spi_sync+0x24/0x3c\nspi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd]\nmcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154\n_regmap_raw_read from _regmap_bus_read+0x44/0x70\n_regmap_bus_read from _regmap_read+0x60/0xd8\n_regmap_read from regmap_read+0x3c/0x5c\nregmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd]\nmcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd]\nmcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78\nirq_thread_fn from irq_thread+0x118/0x1f4\nirq_thread from kthread+0xd8/0xf4\nkthread from ret_from_fork+0x14/0x28\nFix this by also setting message->complete to NULL when the transfer is\ncomplete.

See more information about CVE-2024-36930 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	5.5
Vector String:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	Low
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	None
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (kernel)	ELSA-2024-9315	2024-11-14