CVE-2024-47705

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
21/10/2024
Last modified:
03/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> block: fix potential invalid pointer dereference in blk_add_partition<br /> <br /> The blk_add_partition() function initially used a single if-condition<br /> (IS_ERR(part)) to check for errors when adding a partition. This was<br /> modified to handle the specific case of -ENXIO separately, allowing the<br /> function to proceed without logging the error in this case. However,<br /> this change unintentionally left a path where md_autodetect_dev()<br /> could be called without confirming that part is a valid pointer.<br /> <br /> This commit separates the error handling logic by splitting the<br /> initial if-condition, improving code readability and handling specific<br /> error scenarios explicitly. The function now distinguishes the general<br /> error case from -ENXIO without altering the existing behavior of<br /> md_autodetect_dev() calls.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.227 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.168 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.113 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.54 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.10.13 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.11 (including) 6.11.2 (excluding)