CVE-2024-35891: net: phy: micrel: Fix potential null pointer dereference
In the Linux kernel, the following vulnerability has been resolved:
net: phy: micrel: Fix potential null pointer dereference
In lan8814getsigrx() and lan8814getsigtx() ptpparseheader() may return NULL as ptpheader due to abnormal packet type or corrupted packet. Fix this bug by adding ptpheader check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: phy: micrel: Fix potential null pointer dereference
The Linux kernel CVE team has assigned CVE-2024-35891 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051948-CVE-2024-35891-3a56@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.85 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.26 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35891?
CVE-2024-35891 has a moderate severity rating due to the potential for a null pointer dereference in the Linux kernel.
How do I fix CVE-2024-35891?
To fix CVE-2024-35891, you should update your Linux kernel to a version that includes the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-35891?
CVE-2024-35891 affects Linux kernel versions from 5.18 to below 6.1.85, from 6.2 to below 6.6.26, and from 6.7 to below 6.8.5.
What components are involved in CVE-2024-35891?
CVE-2024-35891 specifically involves the net: phy: micrel components and affects functions like lan8814_get_sig_rx() and lan8814_get_sig_tx().
Are there any specific patched versions for CVE-2024-35891 available?
Yes, patched versions available for CVE-2024-35891 include 5.10.223-1, 5.10.226-1, 6.1.123-1, and several others listed in the vulnerability details.