CVE-2024-35790

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
17/05/2024
Last modified:
03/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: typec: altmodes/displayport: create sysfs nodes as driver&amp;#39;s default device attribute group<br /> <br /> The DisplayPort driver&amp;#39;s sysfs nodes may be present to the userspace before<br /> typec_altmode_set_drvdata() completes in dp_altmode_probe. This means that<br /> a sysfs read can trigger a NULL pointer error by deferencing dp-&gt;hpd in<br /> hpd_show or dp-&gt;lock in pin_assignment_show, as dev_get_drvdata() returns<br /> NULL in those cases.<br /> <br /> Remove manual sysfs node creation in favor of adding attribute group as<br /> default for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is<br /> not used here otherwise the path to the sysfs nodes is no longer compliant<br /> with the ABI.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.19 (including) 6.6.24 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.7.12 (excluding)
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*