CVE-2024-42134
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
30/07/2024
Last modified:
11/12/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
virtio-pci: Check if is_avq is NULL<br />
<br />
[bug]<br />
In the virtio_pci_common.c function vp_del_vqs, vp_dev->is_avq is involved<br />
to determine whether it is admin virtqueue, but this function vp_dev->is_avq<br />
may be empty. For installations, virtio_pci_legacy does not assign a value<br />
to vp_dev->is_avq.<br />
<br />
[fix]<br />
Check whether it is vp_dev->is_avq before use.<br />
<br />
[test]<br />
Test with virsh Attach device<br />
Before this patch, the following command would crash the guest system<br />
<br />
After applying the patch, everything seems to be working fine.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.9.9 (excluding) |
To consult the complete list of CPE names with products and versions, see this page