CVE-2024-46715: driver: iio: add missing checks on iio_info's callback access
In the Linux kernel, the following vulnerability has been resolved:
driver: iio: add missing checks on iioinfo's callback access
Some callbacks from iioinfo structure are accessed without any check, so if a driver doesn't implement them trying to access the corresponding sysfs entries produce a kernel oops such as:
[ 2203.527791] Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute [...] [ 2203.783416] Call trace: [ 2203.783429] iioreadchannelinfoavail from devattrshow+0x18/0x48 [ 2203.789807] devattrshow from sysfskfseqshow+0x90/0x120 [ 2203.794181] sysfskfseqshow from seqreaditer+0xd0/0x4e4 [ 2203.798555] seqreaditer from vfsread+0x238/0x2a0 [ 2203.802236] vfsread from ksysread+0xa4/0xd4 [ 2203.805385] ksysread from retfastsyscall+0x0/0x54 [ 2203.809135] Exception stack(0xe0badfa8 to 0xe0badff0) [ 2203.812880] dfa0: 00000003 b6f10f80 00000003 b6eab000 00020000 00000000 [ 2203.819746] dfc0: 00000003 b6f10f80 7ff00000 00000003 00000003 00000000 00020000 00000000 [ 2203.826619] dfe0: b6e1bc88 bed80958 b6e1bc94 b6e1bcb0 [ 2203.830363] Code: bad PC value [ 2203.832695] ---[ end trace 0000000000000000 ]---
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46715?
CVE-2024-46715 has a high severity rating due to potential unauthorized access to certain sysfs entries.
How do I fix CVE-2024-46715?
To fix CVE-2024-46715, update your Linux kernel to versions 6.1.123-1, 6.1.119-1, or 6.12.11-1 or apply the relevant patches.
Which systems are affected by CVE-2024-46715?
CVE-2024-46715 affects specific versions of the Linux kernel, particularly those between 5.10.223-1 and 6.6.50, and 6.10.9 and 6.7.
What component of the Linux kernel does CVE-2024-46715 affect?
CVE-2024-46715 primarily affects the iio_info structure access in the driver subsystem of the Linux kernel.
Is there a known exploit for CVE-2024-46715?
As of now, there are no publicly known exploits specifically targeting CVE-2024-46715.