CVE-2024-42320: s390/dasd: fix error checks in dasd_copy_pair_store()
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: fix error checks in dasdcopypairstore()
dasdaddbusid() can return an error via ERRPTR() if an allocation fails. However, two callsites in dasdcopypairstore() do not check the result, potentially resulting in a NULL pointer dereference. Fix this by checking the result with ISERR() and returning the error up the stack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Compensating control
In s390/dasd dasd_copy_pair_store(), check the result of dasd_add_busid() with IS_ERR() at both callsites and return the error up the stack to prevent a NULL pointer dereference.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42320?
The severity of CVE-2024-42320 has not been explicitly rated, but it involves error checking issues in the Linux kernel.
How do I fix CVE-2024-42320?
To fix CVE-2024-42320, upgrade to the patched versions of the Linux kernel provided by the distribution maintainers.
Which versions of the Linux kernel are affected by CVE-2024-42320?
CVE-2024-42320 affects Linux kernel versions between 6.1 and 6.6, as well as some versions between 6.7 and 6.10.
What components are involved in CVE-2024-42320?
CVE-2024-42320 specifically involves the s390/dasd component of the Linux kernel responsible for error checks.
Is CVE-2024-42320 a critical vulnerability?
CVE-2024-42320 is not categorized as critical, but proper validation checks in code can prevent potential issues.