CVE-2024-50238: phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend
In the Linux kernel, the following vulnerability has been resolved:
phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend
Commit 413db06c05e7 ("phy: qcom-qmp-usb: clean up probe initialisation") removed most users of the platform device driver data from the qcom-qmp-usb driver, but mistakenly also removed the initialisation despite the data still being used in the runtime PM callbacks. This bug was later reproduced when the driver was copied to create the qmp-usbc driver.
Restore the driver data initialisation at probe to avoid a NULL-pointer dereference on runtime suspend.
Apparently no one uses runtime PM, which currently needs to be enabled manually through sysfs, with these drivers.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50238?
CVE-2024-50238 has a medium severity rating due to the potential for a NULL dereference that can occur during runtime suspension.
How do I fix CVE-2024-50238?
To fix CVE-2024-50238, update your Linux kernel to at least version 6.12.15-1 or apply the appropriate patches from your distribution.
What versions of the Linux Kernel are affected by CVE-2024-50238?
CVE-2024-50238 affects Linux Kernel versions between 6.8.2 and 6.11.7, as well as various 6.12 release candidates.
Is CVE-2024-50238 an easily exploitable vulnerability?
CVE-2024-50238 is not classified as easily exploitable, but it can lead to system instability if an attack is successful.
What are the consequences of CVE-2024-50238 if left unpatched?
If CVE-2024-50238 is left unpatched, it can result in denial of service due to NULL pointer dereferences during runtime operations.