CVE-2024-36893

CVSS v3.1 5.5 (Medium)
55% Progress
EPSS 0.04 % (5th)
0.04% Progress
Affected Products 1
Advisories 11
NVD Status Analyzed

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: Check for port partner validity before consuming it

typec_register_partner() does not guarantee partner registration
to always succeed. In the event of failure, port->partner is set
to the error value or NULL. Given that port->partner validity is
not checked, this results in the following crash:

Unable to handle kernel NULL pointer dereference at virtual address xx
pc : run_state_machine+0x1bc8/0x1c08
lr : run_state_machine+0x1b90/0x1c08
..
Call trace:
run_state_machine+0x1bc8/0x1c08
tcpm_state_machine_work+0x94/0xe4
kthread_worker_fn+0x118/0x328
kthread+0x1d0/0x23c
ret_from_fork+0x10/0x20

To prevent the crash, check for port->partner validity before
derefencing it in all the call sites.

Weaknesses
CWE-476
NULL Pointer Dereference
CVE Status
PUBLISHED
NVD Status
Analyzed
CNA
kernel.org
Published Date
2024-05-30 16:15:12
(3 months ago)
Updated Date
2024-06-10 19:21:29
(3 months ago)

Affected Products

Loading...
Loading...

Configuration #1

    CPE23 From Up To
  Linux Kernel prior 6.1.91 version cpe:2.3:o:linux:linux_kernel < 6.1.91
  Linux Kernel from 6.2 version and prior 6.6.31 version cpe:2.3:o:linux:linux_kernel >= 6.2 < 6.6.31
  Linux Kernel from 6.7 version and prior 6.8.10 version cpe:2.3:o:linux:linux_kernel >= 6.7 < 6.8.10
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...