CVE-2024-47749: RDMA/cxgb4: Added NULL check for lookup_atid
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cxgb4: Added NULL check for lookupatid
The lookupatid() function can return NULL if the ATID is invalid or does not exist in the identifier table, which could lead to dereferencing a null pointer without a check in the actestablish() and actopenrpl() functions. Add a NULL check to prevent null pointer dereferencing.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Apply the code fix in the Linux kernel RDMA/cxgb4 driver: update the act_establish() and act_open_rpl() functions to add a NULL check after lookup_atid(), since lookup_atid() may return NULL for invalid/non-existent ATID values.
Linux kernel (RDMA/cxgb4) NULL check for lookup_atid in act_establish() and act_open_rpl() = Add a NULL check for lookup_atid() before dereferencing the returned pointer
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47749?
The severity of CVE-2024-47749 is high due to the potential for null pointer dereference in the Linux kernel.
How do I fix CVE-2024-47749?
To fix CVE-2024-47749, update your Linux kernel to a version that includes the relevant security patches, such as versions 6.1.123-1 or later.
Which Linux kernel versions are affected by CVE-2024-47749?
CVE-2024-47749 affects Linux kernel versions between 2.6.35 and 6.11.2.
What is the nature of the vulnerability in CVE-2024-47749?
CVE-2024-47749 is a null pointer dereference vulnerability that occurs in the lookup_atid() function of the RDMA/cxgb4 component in the Linux kernel.
Is CVE-2024-47749 specific to any Linux distribution?
CVE-2024-47749 is relevant across multiple Linux distributions, including Debian, which provides specific package updates to address the vulnerability.