CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: mv88e6xxx: Correct check for empty list
Since commit a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses") mv88e6xxxdefaultmdiobus() has checked that the return value of listfirstentry() is non-NULL.
This appears to be intended to guard against the list chip->mdios being empty. However, it is not the correct check as the implementation of listfirstentry is not designed to return NULL for empty lists.
Instead, use listfirstentryornull() which does return NULL if the list is empty.
Flagged by Smatch. Compile tested only.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.137-1Fixed in 6.1.135-1Fixed in 6.12.27-1Fixed in 6.12.29-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade
Linux kernel (net: dsa: mv88e6xxx)to a version that resolves this vulnerability.Patch a3c53be55c95
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42224?
CVE-2024-42224 is considered to have a moderate severity due to its impact on the Linux kernel's networking stack.
How do I fix CVE-2024-42224?
To fix CVE-2024-42224, update to the recommended kernel versions such as 5.10.223-1, 5.10.226-1, or later versions available.
Which Linux kernel versions are affected by CVE-2024-42224?
CVE-2024-42224 affects several kernel versions, specifically those between version 4.11 and 6.6.39, excluding the patched versions.
What components are impacted by CVE-2024-42224?
CVE-2024-42224 impacts the net: dsa: mv88e6xxx component of the Linux kernel, specifically the MDIO bus handling.
Is CVE-2024-42224 exploitable in default configurations?
Yes, CVE-2024-42224 could potentially be exploited in default configurations without proper security measures.