CVE-2024-37021

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
24/06/2024
Last modified:
03/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fpga: manager: add owner module and take its refcount<br /> <br /> The current implementation of the fpga manager assumes that the low-level<br /> module registers a driver for the parent device and uses its owner pointer<br /> to take the module&amp;#39;s refcount. This approach is problematic since it can<br /> lead to a null pointer dereference while attempting to get the manager if<br /> the parent device does not have a driver.<br /> <br /> To address this problem, add a module owner pointer to the fpga_manager<br /> struct and use it to take the module&amp;#39;s refcount. Modify the functions for<br /> registering the manager to take an additional owner module parameter and<br /> rename them to avoid conflicts. Use the old function names for helper<br /> macros that automatically set the module that registers the manager as the<br /> owner. This ensures compatibility with existing low-level control modules<br /> and reduces the chances of registering a manager without setting the owner.<br /> <br /> Also, update the documentation to keep it consistent with the new interface<br /> for registering an fpga manager.<br /> <br /> Other changes: opportunistically move put_device() from __fpga_mgr_get() to<br /> fpga_mgr_get() and of_fpga_mgr_get() to improve code clarity since the<br /> manager device is taken in these functions.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.4 (including) 6.1.120 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.33 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.9.4 (excluding)