| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024061949-CVE-2024-38546-ce19@gregkh> Date: Wed, 19 Jun 2024 15:35:55 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-38546: drm: vc4: Fix possible null pointer dereference Description =========== In the Linux kernel, the following vulnerability has been resolved: drm: vc4: Fix possible null pointer dereference In vc4_hdmi_audio_init() of_get_address() may return NULL which is later dereferenced. Fix this bug by adding NULL check. Found by Linux Verification Center (linuxtesting.org) with SVACE. The Linux kernel CVE team has assigned CVE-2024-38546 to this issue. Affected and fixed versions =========================== Issue introduced in 4.12 with commit bb7d78568814 and fixed in 5.10.219 with commit 2d9adecc88ab Issue introduced in 4.12 with commit bb7d78568814 and fixed in 5.15.161 with commit 6cf1874aec42 Issue introduced in 4.12 with commit bb7d78568814 and fixed in 6.1.93 with commit 80431ea3634e Issue introduced in 4.12 with commit bb7d78568814 and fixed in 6.6.33 with commit 42c22b63056c Issue introduced in 4.12 with commit bb7d78568814 and fixed in 6.8.12 with commit 2a345fe928c2 Issue introduced in 4.12 with commit bb7d78568814 and fixed in 6.9.3 with commit bd7827d46d40 Issue introduced in 4.12 with commit bb7d78568814 and fixed in 6.10-rc1 with commit c534b63bede6 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-38546 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/vc4/vc4_hdmi.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/2d9adecc88ab678785b581ab021f039372c324cb https://git.kernel.org/stable/c/6cf1874aec42058a5ad621a23b5b2f248def0e96 https://git.kernel.org/stable/c/80431ea3634efb47a3004305d76486db9dd8ed49 https://git.kernel.org/stable/c/42c22b63056cea259d5313bf138a834840af85a5 https://git.kernel.org/stable/c/2a345fe928c21de6f3c3c7230ff509d715153a31 https://git.kernel.org/stable/c/bd7827d46d403f8cdb43d16744cb1114e4726b21 https://git.kernel.org/stable/c/c534b63bede6cb987c2946ed4d0b0013a52c5ba7
Powered by blists - more mailing lists