CVE-2024-38611: media: i2c: et8ek8: Don't strip remove function when driver is builtin
In the Linux kernel, the following vulnerability has been resolved:
media: i2c: et8ek8: Don't strip remove function when driver is builtin
Using exit for the remove function results in the remove callback being discarded with CONFIGVIDEOET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally.
This also fixes a W=1 modpost warning:
WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8i2cdriver+0x10 (section: .data) -> et8ek8remove (section: .exit.text)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Compensating control
For the affected Linux kernel driver media/i2c/et8ek8, ensure the remove callback is not stripped/discarded when the driver is builtin (CONFIG_VIDEO_ET8EK8=y) by compiling in the remove callback unconditionally.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38611?
CVE-2024-38611 is classified with a medium severity level due to potential impacts on device functionality when the remove function is improperly discarded.
How do I fix CVE-2024-38611?
To fix CVE-2024-38611, upgrade the Linux kernel to version 6.12.12-1 or later.
Which Linux kernel versions are affected by CVE-2024-38611?
CVE-2024-38611 affects Linux kernel versions up to 5.10.226-1 and 6.1.128-1.
Is there a workaround for CVE-2024-38611?
There are no specific workarounds for CVE-2024-38611; the recommended solution is to apply the necessary kernel updates.
What component of the Linux kernel is impacted by CVE-2024-38611?
CVE-2024-38611 impacts the media: i2c: et8ek8 driver component within the Linux kernel.