CVE-2024-42107

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-42107
In the Linux kernel, the following vulnerability has been resolved: ice: Don't process extts if PTP is disabled The ice_ptp_extts_event() function can race with ice_ptp_release() and result in a NULL pointer dereference which leads to a kernel panic. Panic occurs because the ice_ptp_extts_event() function calls ptp_clock_event() with a NULL pointer. The ice driver has already released the PTP clock by the time the interrupt for the next external timestamp event occurs. To fix this, modify the ice_ptp_extts_event() function to check the PTP state and bail early if PTP is not ready.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1c4e524811918600683b1ea87a5e0fc2db64fa9b Patch
https://git.kernel.org/stable/c/996422e3230e41468f652d754fefd1bdbcd4604e Patch
https://git.kernel.org/stable/c/1c4e524811918600683b1ea87a5e0fc2db64fa9b Patch
https://git.kernel.org/stable/c/996422e3230e41468f652d754fefd1bdbcd4604e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*
History

08 Jan 2025, 21:32

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1c4e524811918600683b1ea87a5e0fc2db64fa9b - () https://git.kernel.org/stable/c/1c4e524811918600683b1ea87a5e0fc2db64fa9b - Patch
References () https://git.kernel.org/stable/c/996422e3230e41468f652d754fefd1bdbcd4604e - () https://git.kernel.org/stable/c/996422e3230e41468f652d754fefd1bdbcd4604e - Patch
First Time Linux linux Kernel
Linux
CWE CWE-367
CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CPE cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*

21 Nov 2024, 09:33

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1c4e524811918600683b1ea87a5e0fc2db64fa9b - () https://git.kernel.org/stable/c/1c4e524811918600683b1ea87a5e0fc2db64fa9b -
References () https://git.kernel.org/stable/c/996422e3230e41468f652d754fefd1bdbcd4604e - () https://git.kernel.org/stable/c/996422e3230e41468f652d754fefd1bdbcd4604e -

30 Jul 2024, 13:32

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: no procesar extts si PTP está deshabilitado. La función ice_ptp_extts_event() puede competir con ice_ptp_release() y provocar una desreferencia del puntero NULL que provoca un pánico en el kernel. El pánico ocurre porque la función ice_ptp_extts_event() llama a ptp_clock_event() con un puntero NULL. El controlador de hielo ya ha liberado el reloj PTP cuando ocurre la interrupción para el siguiente evento de marca de tiempo externo. Para solucionar este problema, modifique la función ice_ptp_extts_event() para verificar el estado de PTP y salir temprano si PTP no está listo.

30 Jul 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-30 08:15

Updated : 2025-01-08 21:32

NVD link : CVE-2024-42107

Mitre link : CVE-2024-42107

CVE.ORG link : CVE-2024-42107

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-476

NULL Pointer Dereference