CVE-2024-38637: greybus: lights: check return of get_channel_from_mode
In the Linux kernel, the following vulnerability has been resolved:
greybus: lights: check return of getchannelfrommode
If channel for the given node is not found we return null from getchannelfrommode. Make sure we validate the return pointer before using it in two of the missing places.
This was originally reported in [0]: Found by Linux Verification Center (linuxtesting.org) with SVACE.
[0] https://lore.kernel.org/all/20240301190425.120605-1-m.lobanov@rosalinux.ru
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.94-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.7-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the Linux kernel greybus lights code, validate the return pointer from get_channel_from_mode before using it in the two missing call sites, because the function returns NULL when the channel for the given node is not found.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38637?
The severity of CVE-2024-38637 has not been explicitly rated, but it addresses a potential issue in the Linux kernel that could lead to unexpected behavior.
How do I fix CVE-2024-38637?
To fix CVE-2024-38637, ensure you are running the updated Linux kernel versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, or 6.12.12-1.
What software is affected by CVE-2024-38637?
CVE-2024-38637 affects specific versions of the Linux kernel as listed in the vulnerability details.
What components are involved in CVE-2024-38637?
CVE-2024-38637 involves the greybus component and the lights functionality within the Linux kernel.
What could happen if CVE-2024-38637 is exploited?
If exploited, CVE-2024-38637 could lead to null pointer dereferences that may impact system stability and functionality.