NULL Pointer Dereference Affecting kernel-64kb-devel package, versions <6.4.0-150600.23.14.1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-SLES156-KERNEL64KBDEVEL-7554061
- published 23 Jul 2024
- disclosed 22 Jul 2024
Introduced: 22 Jul 2024
CVE-2024-38633 Open this link in a new tabHow to fix?
Upgrade SLES:15.6 kernel-64kb-devel to version 6.4.0-150600.23.14.1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-64kb-devel package and not the kernel-64kb-devel package as distributed by SLES.
See How to fix? for SLES:15.6 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
serial: max3100: Update uart_driver_registered on driver removal
The removal of the last MAX3100 device triggers the removal of the driver. However, code doesn't update the respective global variable and after insmod — rmmod — insmod cycle the kernel oopses:
max3100 spi-PRP0001:01: max3100_probe: adding port 0 BUG: kernel NULL pointer dereference, address: 0000000000000408 ... RIP: 0010:serial_core_register_port+0xa0/0x840 ... max3100_probe+0x1b6/0x280 [max3100] spi_probe+0x8d/0xb0
Update the actual state so next time UART driver will be registered again.
Hugo also noticed, that the error path in the probe also affected by having the variable set, and not cleared. Instead of clearing it move the assignment after the successfull uart_register_driver() call.
References
- https://www.suse.com/security/cve/CVE-2024-38633.html
- https://bugzilla.suse.com/1226867
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://git.kernel.org/stable/c/21a61a7fbcfdd3493cede43ebc7c4dfae2147a8b
- https://git.kernel.org/stable/c/361a92c9038e8c8c3996f8eeaa14522a8ad90752
- https://git.kernel.org/stable/c/712a1fcb38dc7cac6da63ee79a88708fbf9c45ec
- https://git.kernel.org/stable/c/9db4222ed8cd3e50b81c8b910ae74c26427a4003
- https://git.kernel.org/stable/c/b6eb7aff23e05f362e8c9b560f6ac5e727b70e00
- https://git.kernel.org/stable/c/e8a10089eddba40d4b2080c9d3fc2d2b2488f762
- https://git.kernel.org/stable/c/e8e2a4339decad7e59425b594a98613402652d72
- https://git.kernel.org/stable/c/fa84ca78b048dfb00df0ef446f5c35e0a98ca6a0