| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 17 May 2024 15:23:36 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-35796: net: ll_temac: platform_get_resource replaced by wrong function Description =========== In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: platform_get_resource replaced by wrong function The function platform_get_resource was replaced with devm_platform_ioremap_resource_byname and is called using 0 as name. This eventually ends up in platform_get_resource_byname in the call stack, where it causes a null pointer in strcmp. if (type == resource_type(r) && !strcmp(r->name, name)) It should have been replaced with devm_platform_ioremap_resource. The Linux kernel CVE team has assigned CVE-2024-35796 to this issue. Affected and fixed versions =========================== Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 5.10.215 with commit 6d9395ba7f85 Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 5.15.154 with commit 553d294db94b Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 6.1.84 with commit 46efbdbc95a3 Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 6.6.24 with commit 476eed5f1c22 Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 6.7.12 with commit 7e9edb569fd9 Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 6.8.3 with commit 92c0c29f6678 Issue introduced in 5.9 with commit bd69058f50d5 and fixed in 6.9 with commit 3a38a829c8bc Issue introduced in 5.8.2 with commit 77c8cfdf8084 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-35796 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/ethernet/xilinx/ll_temac_main.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/6d9395ba7f85bdb7af0b93272e537484ecbeff48 https://git.kernel.org/stable/c/553d294db94b5f139378022df480a9fb6c3ae39e https://git.kernel.org/stable/c/46efbdbc95a30951c2579caf97b6df2ee2b3bef3 https://git.kernel.org/stable/c/476eed5f1c22034774902a980aa48dc4662cb39a https://git.kernel.org/stable/c/7e9edb569fd9f688d887e36db8170f6e22bafbc8 https://git.kernel.org/stable/c/92c0c29f667870f17c0b764544bdf22ce0e886a1 https://git.kernel.org/stable/c/3a38a829c8bc27d78552c28e582eb1d885d07d11
Powered by blists - more mailing lists