Bug 2320276 (CVE-2024-47743) - CVE-2024-47743 kernel: KEYS: prevent NULL pointer dereference in find_asymmetric_key()
Summary: CVE-2024-47743 kernel: KEYS: prevent NULL pointer dereference in find_asymmet...
Keywords:
Status: NEW
Alias: CVE-2024-47743
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2320335
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-10-21 13:07 UTC by OSIDB Bzimport
Modified: 2024-10-21 20:34 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2024-10-21 13:07:38 UTC
In the Linux kernel, the following vulnerability has been resolved:

KEYS: prevent NULL pointer dereference in find_asymmetric_key()

In find_asymmetric_key(), if all NULLs are passed in the id_{0,1,2}
arguments, the kernel will first emit WARN but then have an oops
because id_2 gets dereferenced anyway.

Add the missing id_2 check and move WARN_ON() to the final else branch
to avoid duplicate NULL checks.

Found by Linux Verification Center (linuxtesting.org) with Svace static
analysis tool.


Note You need to log in before you can comment on or make changes to this bug.