| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024091338-CVE-2024-46685-6606@gregkh> Date: Fri, 13 Sep 2024 07:30:46 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-46685: pinctrl: single: fix potential NULL dereference in pcs_get_function() Description =========== In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix potential NULL dereference in pcs_get_function() pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in pcs_get_function(). Found by code review. The Linux kernel CVE team has assigned CVE-2024-46685 to this issue. Affected and fixed versions =========================== Issue introduced in 4.11 with commit 571aec4df5b7 and fixed in 4.19.321 with commit 0a2bab5ed161 Issue introduced in 4.11 with commit 571aec4df5b7 and fixed in 5.4.283 with commit 2cea369a5c2e Issue introduced in 4.11 with commit 571aec4df5b7 and fixed in 5.10.225 with commit 4e9436375fcc Issue introduced in 4.11 with commit 571aec4df5b7 and fixed in 5.15.166 with commit 6341c2856785 Issue introduced in 4.11 with commit 571aec4df5b7 and fixed in 6.1.108 with commit 8f0bd526921b Issue introduced in 4.11 with commit 571aec4df5b7 and fixed in 6.6.49 with commit 4ed45fe99ec9 Issue introduced in 4.11 with commit 571aec4df5b7 and fixed in 6.10.8 with commit 292151af6add Issue introduced in 4.11 with commit 571aec4df5b7 and fixed in 6.11-rc6 with commit 1c38a62f15e5 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-46685 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/pinctrl/pinctrl-single.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/0a2bab5ed161318f57134716accba0a30f3af191 https://git.kernel.org/stable/c/2cea369a5c2e85ab14ae716da1d1cc6d25c85e11 https://git.kernel.org/stable/c/4e9436375fcc9bd2a60ee96aba6ed53f7a377d10 https://git.kernel.org/stable/c/6341c2856785dca7006820b127278058a180c075 https://git.kernel.org/stable/c/8f0bd526921b6867c2f10a83cd4fd14139adcd92 https://git.kernel.org/stable/c/4ed45fe99ec9e3c9478bd634624cd05a57d002f7 https://git.kernel.org/stable/c/292151af6add3e5ab11b2e9916cffa5f52859a1f https://git.kernel.org/stable/c/1c38a62f15e595346a1106025722869e87ffe044
Powered by blists - more mailing lists