CVE-2024-43860: remoteproc: imx_rproc: Skip over memory region when node value is NULL
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: imxrproc: Skip over memory region when node value is NULL
In imxrprocaddrinit() "nph = ofcountphandlewithargs()" just counts number of phandles. But phandles may be empty. So ofparsephandle() in the parsing loop (0 < a < nph) may return NULL which is later dereferenced. Adjust this issue by adding NULL-return check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[Fixed title to fit within the prescribed 70-75 charcters]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Compensating control
Add a NULL-return check after of_parse_phandle() in imx_rproc_addr_init() and skip the memory region when the returned node value is NULL or the phandle is empty, preventing later dereference.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43860?
CVE-2024-43860 has been rated as high severity due to its potential impact on kernel functionality.
How do I fix CVE-2024-43860?
To fix CVE-2024-43860, update the Linux kernel to the latest recommended version which addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-43860?
CVE-2024-43860 affects Linux kernel versions from 4.14 up to, but not including, 4.19.320, as well as several other specified version ranges.
Is there a workaround for CVE-2024-43860?
No official workaround exists for CVE-2024-43860, so upgrading to a secure kernel version is recommended.
Who should be concerned about CVE-2024-43860?
System administrators and organizations using affected versions of the Linux kernel should be particularly concerned about CVE-2024-43860.