CVE-2024-43875: PCI: endpoint: Clean up error handling in vpci_scan_bus()
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: Clean up error handling in vpciscanbus()
Smatch complains about inconsistent NULL checking in vpciscanbus():
drivers/pci/endpoint/functions/pci-epf-vntb.c:1024 vpciscanbus() error: we previously assumed 'vpcibus' could be null (see line 1021)
Instead of printing an error message and then crashing we should return an error code and clean up.
Also the NULL check is reversed so it prints an error for success instead of failure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43875?
CVE-2024-43875 has been classified with a moderate severity level due to potential inconsistencies in NULL checking.
How do I fix CVE-2024-43875?
To resolve CVE-2024-43875, you should upgrade to the fixed kernel versions: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which versions of Linux are affected by CVE-2024-43875?
CVE-2024-43875 affects various versions of the Linux kernel, specifically those prior to the specified remedy versions.
Is there a patch available for CVE-2024-43875?
Yes, patches have been applied in the updated kernel versions that remediate CVE-2024-43875.
What component of the Linux kernel does CVE-2024-43875 affect?
CVE-2024-43875 affects the PCI endpoint functionality within the Linux kernel.