CVE-2024-49941: gpiolib: Fix potential NULL pointer dereference in gpiod_get_label()
In the Linux kernel, the following vulnerability has been resolved:
gpiolib: Fix potential NULL pointer dereference in gpiodgetlabel()
In gpiodgetlabel(), it is possible that srcudereferencecheck() may return a NULL pointer, leading to a scenario where label->str is accessed without verifying if label itself is NULL.
This patch adds a proper NULL check for label before accessing label->str. The check for label->str != NULL is removed because label->str can never be NULL if label is not NULL.
This fixes the issue where the label name was being printed as (efault) when dumping the sysfs GPIO file when label == NULL.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49941?
CVE-2024-49941 has not been assigned a CVSS score yet, but it could potentially lead to denial of service due to a NULL pointer dereference.
How do I fix CVE-2024-49941?
To fix CVE-2024-49941, update your Linux kernel to the latest version where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2024-49941?
CVE-2024-49941 affects Linux kernel versions 6.9 through 6.11.3 and 6.12-rc1.
What components are impacted by CVE-2024-49941?
CVE-2024-49941 impacts the gpiod subsystem, specifically the gpiod_get_label() function.
Is CVE-2024-49941 a critical vulnerability?
CVE-2024-49941 may lead to system crashes; however, its criticality depends on the specific use cases and deployment environments.