CVE-2024-50239: phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend
In the Linux kernel, the following vulnerability has been resolved:
phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend
Commit 413db06c05e7 ("phy: qcom-qmp-usb: clean up probe initialisation") removed most users of the platform device driver data from the qcom-qmp-usb driver, but mistakenly also removed the initialisation despite the data still being used in the runtime PM callbacks. This bug was later reproduced when the driver was copied to create the qmp-usb-legacy driver.
Restore the driver data initialisation at probe to avoid a NULL-pointer dereference on runtime suspend.
Apparently no one uses runtime PM, which currently needs to be enabled manually through sysfs, with these drivers.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50239?
CVE-2024-50239 has not been assigned a specific CVSS score, but it is a critical security issue due to its potential impact on device stability.
How do I fix CVE-2024-50239?
To fix CVE-2024-50239, update the Linux Kernel to a version that includes the commit that addresses this vulnerability.
Which versions of the Linux Kernel are affected by CVE-2024-50239?
CVE-2024-50239 affects Linux Kernel versions specifically between 6.7 and 6.11.7, and 6.12 release candidates up to 6.12-rc5.
What type of vulnerability is CVE-2024-50239?
CVE-2024-50239 is a NULL dereference vulnerability that can occur during the runtime suspension of devices.
When was CVE-2024-50239 resolved?
CVE-2024-50239 was resolved with a commit to the Linux Kernel, addressing the issue related to the qcom-qmp-usb driver.