CVE-2024-43824: PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-epf-test: Make use of cached 'epcfeatures' in pciepftestcoreinit()
Instead of getting the epcfeatures from pciepcgetfeatures() API, use the cached pciepftest::epcfeatures value to avoid the NULL check. Since the NULL check is already performed in pciepftestbind(), having one more check in pciepftestcoreinit() is redundant and it is not possible to hit the NULL pointer dereference.
Also with commit a01e7214bef9 ("PCI: endpoint: Remove "coreinitnotifier" flag"), 'epcfeatures' got dereferenced without the NULL check, leading to the following false positive Smatch warning:
drivers/pci/endpoint/functions/pci-epf-test.c:784 pciepftestcoreinit() error: we previously assumed 'epcfeatures' could be null (see line 747)
Thus, remove the redundant NULL check and also use the epcfeatures:: {msixcapable/msicapable} flags directly to avoid local variables.
[kwilczynski: commit log]
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43824?
The severity of CVE-2024-43824 is classified as moderate.
How do I fix CVE-2024-43824?
To fix CVE-2024-43824, update your Linux kernel to version 6.12.11-1 or later.
What components are affected by CVE-2024-43824?
CVE-2024-43824 affects the PCI endpoint function in the Linux kernel, specifically versions from 5.7 to 6.10.3.
Is CVE-2024-43824 exploitable remotely?
CVE-2024-43824 is not considered to be remotely exploitable.
What are the potential impacts of CVE-2024-43824?
The potential impacts of CVE-2024-43824 include kernel instability and unintended behavior of PCI endpoint functionality.