PT-2024-20619 · Linux · Linux Kernel

Published 2024-04-14 · Updated 2024-05-29 · CVE-2024-24862

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux Kernel versions up to 6.9-rc2

Description The issue is related to a potential null pointer dereference in the pci1xxxx spi probe function. This could be caused by a failed memory allocation by the devm kzalloc function. To prevent null pointer dereferencing, a null pointer check needs to be added. The memory allocated by devm kzalloc will be automatically released.

Recommendations To fix this issue, check spi bus->spi int[iter] to prevent null pointer dereferencing. If the memory allocation fails, directly return -ENOMEM without worrying about memory leaks. Upgrade the affected kernel component immediately to mitigate this local attack vector.

Related Identifiers

CVE-2024-24862

Affected Products

Linux Kernel

References · 9

• https://ubuntu.com/security/CVE-2024-24862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24862 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-24862 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-24862 · Vendor Advisory
• https://t.me/cvenotify/76685 · Telegram Post
• https://twitter.com/oktsec/status/1779535798724943916 · Twitter Post
• https://twitter.com/CVEnew/status/1779517616563822903 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1779518955931025466 · Twitter Post
• https://bugzilla.openanolis.cn/show_bug.cgi?id=8748 · Note