PT-2024-14722 · Linux+5 · Linux Kernel+5
Mark Hasemeyer
·
Published
2023-11-10
·
Updated
2026-05-26
·
CVE-2023-52749
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A race condition exists in the Linux kernel where a synchronous transfer can be active during a system suspend, causing a null pointer dereference exception when the system resumes. This occurs due to the following sequence of events:
spi sync()callsspi transfer message noqueue()which setsctlr->cur msg.- Spi transfer begins via
spi transfer one message(). - The system is suspended, interrupting the transfer context.
- The system is resumed.
spi controller resume()callsspi start queue()which resetscur msgto NULL.- The spi transfer context resumes and
spi finalize current message()is called, which dereferencescur msg(now NULL). To resolve this issue, the kernel waits for synchronous transfers to complete before suspending by acquiring the bus mutex and setting/checking a suspend flag.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
NULL Pointer Dereference
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian
Linux Kernel
Red Hat
Red Os
Suse