CVE-2024-27028: spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
In the Linux kernel, the following vulnerability has been resolved:
spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
The TX buffer in spitransfer can be a NULL pointer, so the interrupt handler may end up writing to the invalid memory and cause crashes.
Add a check to trans->txbuf before using it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Compensating control
Add a NULL check to trans->tx_buf before using it in the spi-mt65xx interrupt handler.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27028?
CVE-2024-27028 has a medium severity rating due to the potential for system crashes caused by a NULL pointer dereference in the interrupt handler.
How do I fix CVE-2024-27028?
To fix CVE-2024-27028, you should upgrade to one of the patched kernel versions such as 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which Linux versions are affected by CVE-2024-27028?
CVE-2024-27028 affects the Linux kernel versions prior to the specified patched versions that contain the fix.
What component of the Linux kernel is impacted by CVE-2024-27028?
CVE-2024-27028 impacts the SPI (Serial Peripheral Interface) component specifically related to the spi-mt65xx driver.
Is CVE-2024-27028 a locally exploitable vulnerability?
CVE-2024-27028 is considered a locally exploitable vulnerability, as it requires access to the system to exploit the NULL pointer dereference.