CVE-2024-35883: spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe
In the Linux kernel, the following vulnerability has been resolved:
spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxxspiprobe
In function pci1xxxxspiprobe, there is a potential null pointer that may be caused by a failed memory allocation by the function devmkzalloc. Hence, a null pointer check needs to be added to prevent null pointer dereferencing later in the code.
To fix this issue, spibus->spiint[iter] should be checked. The memory allocated by devmkzalloc will be automatically released, so just directly return -ENOMEM without worrying about memory leaks.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35883?
CVE-2024-35883 has a severity rating that is categorized under the Common Vulnerability Scoring System due to its potential to cause a null pointer dereference.
How do I fix CVE-2024-35883?
To fix CVE-2024-35883, update the Linux kernel to the latest available version that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-35883?
CVE-2024-35883 affects Linux kernel versions from 6.2 to 6.6.26 and from 6.7 to 6.8.5, along with 6.9-rc1 and 6.9-rc2.
What causes the vulnerability CVE-2024-35883?
CVE-2024-35883 is caused by a possible null pointer dereference that may result from a failed memory allocation in the pci1xxx_spi_probe function.
Is there a patch available for CVE-2024-35883?
Yes, there are specific patched versions available such as 6.12.11-1 and 6.12.12-1 in the Debian package system.