CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized
In the Linux kernel, the following vulnerability has been resolved:
OPP: fix devpmoppfindbw() when bandwidth table not initialized
If a driver calls devpmoppfindbwceil/floor() the retrieve bandwidth from the OPP table but the bandwidth table was not created because the interconnect properties were missing in the OPP consumer node, the kernel will crash with:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 ... pc : readbw+0x8/0x10 lr : opptablefindkey+0x9c/0x174 ... Call trace: readbw+0x8/0x10 (P) opptablefindkey+0x9c/0x174 (L) findkey+0x98/0x168 devpmoppfindbwceil+0x50/0x88 ...
In order to fix the crash, create an assert function to check if the bandwidth table was created before trying to get a bandwidth with readbw().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.13-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Add an assertion or guard that verifies the bandwidth table was created before retrieving bandwidth with _read_bw() from dev_pm_opp_find_bw_ceil() or dev_pm_opp_find_bw_floor().
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58068?
CVE-2024-58068 is classified as a medium-severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-58068?
To fix CVE-2024-58068, ensure you update to the latest stable version of the Linux kernel where the vulnerability has been resolved.
What are the potential impacts of CVE-2024-58068?
The potential impacts of CVE-2024-58068 include system instability or unexpected behavior in drivers that rely on the bandwidth table.
Which systems are affected by CVE-2024-58068?
CVE-2024-58068 affects systems running vulnerable versions of the Linux kernel.
What components of the Linux kernel are involved in CVE-2024-58068?
CVE-2024-58068 involves the OPP (Operating Performance Point) subsystem, specifically functions for retrieving bandwidth from the OPP table.