Bug 2300551 (CVE-2024-42089) - CVE-2024-42089 kernel: ASoC: fsl-asoc-card: set priv-->pdev before using it
Summary: CVE-2024-42089 kernel: ASoC: fsl-asoc-card: set priv-->pdev before using it
Keywords:
Status: NEW
Alias: CVE-2024-42089
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2301741 2307208
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-29 17:30 UTC by OSIDB Bzimport
Modified: 2024-09-19 16:37 UTC (History)
4 users (show)

Fixed In Version: kernel 4.19.317, kernel 5.4.279, kernel 5.10.221, kernel 5.15.162, kernel 6.1.97, kernel 6.6.37, kernel 6.9.8, kernel 6.10
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2024-07-29 17:30:15 UTC
In the Linux kernel, the following vulnerability has been resolved:

ASoC: fsl-asoc-card: set priv->pdev before using it

priv->pdev pointer was set after being used in
fsl_asoc_card_audmux_init().
Move this assignment at the start of the probe function, so
sub-functions can correctly use pdev through priv.

fsl_asoc_card_audmux_init() dereferences priv->pdev to get access to the
dev struct, used with dev_err macros.
As priv is zero-initialised, there would be a NULL pointer dereference.
Note that if priv->dev is dereferenced before assignment but never used,
for example if there is no error to be printed, the driver won't crash
probably due to compiler optimisations.

Comment 1 Mauro Matteo Cascella 2024-07-30 17:28:24 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024072945-CVE-2024-42089-811c@gregkh/T

Comment 2 Mauro Matteo Cascella 2024-07-30 17:28:46 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2301741]


Note You need to log in before you can comment on or make changes to this bug.