CVE-2024-42092: gpio: davinci: Validate the obtained number of IRQs
In the Linux kernel, the following vulnerability has been resolved:
gpio: davinci: Validate the obtained number of IRQs
Value of pdata->gpiounbanked is taken from Device Tree. In case of broken DT due to any error this value can be any. Without this value validation there can be out of chips->irqs array boundaries access in davincigpioprobe().
Validate the obtained nirq value so that it won't exceed the maximum number of IRQs per bank.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42092?
CVE-2024-42092 is considered a medium severity vulnerability that affects the Linux kernel.
How do I fix CVE-2024-42092?
To fix CVE-2024-42092, update the Linux kernel to one of the following remedied versions: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What versions of the Linux kernel are affected by CVE-2024-42092?
CVE-2024-42092 affects specific versions of the Linux kernel prior to the patched versions listed in the remedy.
Is CVE-2024-42092 exploitable remotely?
The exploitability of CVE-2024-42092 depends on the specific system configuration and use, but it is typically related to local access.
What impact does CVE-2024-42092 have on system security?
CVE-2024-42092 can lead to potential privilege escalation if not mitigated through proper kernel updates.