linux-cve-announce - CVE-2024-50012: cpufreq: Avoid a bad reference count on CPU node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024102109-CVE-2024-50012-db7d@gregkh>
Date: Mon, 21 Oct 2024 20:54:16 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-50012: cpufreq: Avoid a bad reference count on CPU node

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: Avoid a bad reference count on CPU node

In the parse_perf_domain function, if the call to
of_parse_phandle_with_args returns an error, then the reference to the
CPU device node that was acquired at the start of the function would not
be properly decremented.

Address this by declaring the variable with the __free(device_node)
cleanup attribute.

The Linux kernel CVE team has assigned CVE-2024-50012 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.6.55 with commit 0f41f383b5a6
	Fixed in 6.10.14 with commit 77f88b17387a
	Fixed in 6.11.3 with commit 47cb1d9278f1
	Fixed in 6.12-rc2 with commit c0f02536fffb

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-50012
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/linux/cpufreq.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0f41f383b5a61a2bf6429a449ebba7fb08179d81
	https://git.kernel.org/stable/c/77f88b17387a017416babf1e6488fa17682287e2
	https://git.kernel.org/stable/c/47cb1d9278f179df8250304ec41009e3e836a926
	https://git.kernel.org/stable/c/c0f02536fffbbec71aced36d52a765f8c4493dc2