[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2024051736-CVE-2024-35796-e66c@gregkh>
Date: Fri, 17 May 2024 15:23:36 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-35796: net: ll_temac: platform_get_resource replaced by wrong function
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
net: ll_temac: platform_get_resource replaced by wrong function
The function platform_get_resource was replaced with
devm_platform_ioremap_resource_byname and is called using 0 as name.
This eventually ends up in platform_get_resource_byname in the call
stack, where it causes a null pointer in strcmp.
if (type == resource_type(r) && !strcmp(r->name, name))
It should have been replaced with devm_platform_ioremap_resource.
The Linux kernel CVE team has assigned CVE-2024-35796 to this issue.
Affected and fixed versions
===========================
Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 5.10.215 with commit 6d9395ba7f85
Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 5.15.154 with commit 553d294db94b
Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 6.1.84 with commit 46efbdbc95a3
Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 6.6.24 with commit 476eed5f1c22
Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 6.7.12 with commit 7e9edb569fd9
Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 6.8.3 with commit 92c0c29f6678
Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 6.9 with commit 3a38a829c8bc
Issue introduced in 5.8.2 with commit 77c8cfdf8084
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2024-35796
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/net/ethernet/xilinx/ll_temac_main.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/6d9395ba7f85bdb7af0b93272e537484ecbeff48
https://git.kernel.org/stable/c/553d294db94b5f139378022df480a9fb6c3ae39e
https://git.kernel.org/stable/c/46efbdbc95a30951c2579caf97b6df2ee2b3bef3
https://git.kernel.org/stable/c/476eed5f1c22034774902a980aa48dc4662cb39a
https://git.kernel.org/stable/c/7e9edb569fd9f688d887e36db8170f6e22bafbc8
https://git.kernel.org/stable/c/92c0c29f667870f17c0b764544bdf22ce0e886a1
https://git.kernel.org/stable/c/3a38a829c8bc27d78552c28e582eb1d885d07d11
Powered by blists - more mailing lists