CVE-2024-26866

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26866
In the Linux kernel, the following vulnerability has been resolved: spi: lpspi: Avoid potential use-after-free in probe() fsl_lpspi_probe() is allocating/disposing memory manually with spi_alloc_host()/spi_alloc_target(), but uses devm_spi_register_controller(). In case of error after the latter call the memory will be explicitly freed in the probe function by spi_controller_put() call, but used afterwards by "devm" management outside probe() (spi_unregister_controller() <- devm_spi_unregister() below). Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070 ... Call trace: kernfs_find_ns kernfs_find_and_get_ns sysfs_remove_group sysfs_remove_groups device_remove_attrs device_del spi_unregister_controller devm_spi_unregister release_nodes devres_release_all really_probe driver_probe_device __device_attach_driver bus_for_each_drv __device_attach device_initial_probe bus_probe_device deferred_probe_work_func process_one_work worker_thread kthread ret_from_fork

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1543418e82789cc383cd36d41469983c64e3fc7f Patch
https://git.kernel.org/stable/c/2ae0ab0143fcc06190713ed81a6486ed0ad3c861 Patch
https://git.kernel.org/stable/c/996ce839606afd0fef91355627868022aa73eb68 Patch
https://git.kernel.org/stable/c/da83ed350e4604b976e94239b08d8e2e7eaee7ea Patch
https://git.kernel.org/stable/c/1543418e82789cc383cd36d41469983c64e3fc7f Patch
https://git.kernel.org/stable/c/2ae0ab0143fcc06190713ed81a6486ed0ad3c861 Patch
https://git.kernel.org/stable/c/996ce839606afd0fef91355627868022aa73eb68 Patch
https://git.kernel.org/stable/c/da83ed350e4604b976e94239b08d8e2e7eaee7ea Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

27 Jan 2025, 15:08

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1543418e82789cc383cd36d41469983c64e3fc7f - () https://git.kernel.org/stable/c/1543418e82789cc383cd36d41469983c64e3fc7f - Patch
References () https://git.kernel.org/stable/c/2ae0ab0143fcc06190713ed81a6486ed0ad3c861 - () https://git.kernel.org/stable/c/2ae0ab0143fcc06190713ed81a6486ed0ad3c861 - Patch
References () https://git.kernel.org/stable/c/996ce839606afd0fef91355627868022aa73eb68 - () https://git.kernel.org/stable/c/996ce839606afd0fef91355627868022aa73eb68 - Patch
References () https://git.kernel.org/stable/c/da83ed350e4604b976e94239b08d8e2e7eaee7ea - () https://git.kernel.org/stable/c/da83ed350e4604b976e94239b08d8e2e7eaee7ea - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-416
First Time Linux linux Kernel
Linux

21 Nov 2024, 09:03

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi: lpspi: evita el posible use-after-free en probe() fsl_lpspi_probe() está asignando/eliminando memoria manualmente con spi_alloc_host()/spi_alloc_target(), pero usa devm_spi_register_controller() . En caso de error después de la última llamada, la memoria se liberará explícitamente en la función de sonda mediante la llamada a spi_controller_put(), pero la administración "devm" externa a probe() la utilizará después (spi_unregister_controller() &lt;- devm_spi_unregister() a continuación). No se puede manejar la desreferencia del puntero NULL del kernel en la dirección virtual 0000000000000070... Rastreo de llamadas: kernfs_find_ns kernfs_find_and_get_ns sysfs_remove_group sysfs_remove_groups device_remove_attrs device_del spi_unregister_controller devm_spi_unregister release_nodes devres_release _todos realmente_probe driver_probe_device __device_attach_driver bus_for_each_drv __device_attach dispositivo_initial_probe bus_probe_device deferred_probe_work_func proceso_one_work trabajador_hilo kthread ret_from_fork
References () https://git.kernel.org/stable/c/1543418e82789cc383cd36d41469983c64e3fc7f - () https://git.kernel.org/stable/c/1543418e82789cc383cd36d41469983c64e3fc7f -
References () https://git.kernel.org/stable/c/2ae0ab0143fcc06190713ed81a6486ed0ad3c861 - () https://git.kernel.org/stable/c/2ae0ab0143fcc06190713ed81a6486ed0ad3c861 -
References () https://git.kernel.org/stable/c/996ce839606afd0fef91355627868022aa73eb68 - () https://git.kernel.org/stable/c/996ce839606afd0fef91355627868022aa73eb68 -
References () https://git.kernel.org/stable/c/da83ed350e4604b976e94239b08d8e2e7eaee7ea - () https://git.kernel.org/stable/c/da83ed350e4604b976e94239b08d8e2e7eaee7ea -

17 Apr 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-17 11:15

Updated : 2025-01-27 15:08

NVD link : CVE-2024-26866

Mitre link : CVE-2024-26866

CVE.ORG link : CVE-2024-26866

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free