CVE-2024-35247

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
24/06/2024
Last modified:
03/02/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fpga: region: add owner module and take its refcount<br /> <br /> The current implementation of the fpga region assumes that the low-level<br /> module registers a driver for the parent device and uses its owner pointer<br /> to take the module&amp;#39;s refcount. This approach is problematic since it can<br /> lead to a null pointer dereference while attempting to get the region<br /> during programming if the parent device does not have a driver.<br /> <br /> To address this problem, add a module owner pointer to the fpga_region<br /> struct and use it to take the module&amp;#39;s refcount. Modify the functions for<br /> registering a region to take an additional owner module parameter and<br /> rename them to avoid conflicts. Use the old function names for helper<br /> macros that automatically set the module that registers the region as the<br /> owner. This ensures compatibility with existing low-level control modules<br /> and reduces the chances of registering a region without setting the owner.<br /> <br /> Also, update the documentation to keep it consistent with the new interface<br /> for registering an fpga region.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.10 (including) 5.10.219 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.161 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.93 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.33 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.9.4 (excluding)