Bug 1227089 (CVE-2024-39466)

Summary:	VUL-0: CVE-2024-39466: kernel: thermal/drivers/qcom/lmh: Check for SCM availability at probe
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	carlos.lopez, mhocko
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/412099/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-39466:4.7:(AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-06-26 14:03:56 UTC

In the Linux kernel, the following vulnerability has been resolved:

thermal/drivers/qcom/lmh: Check for SCM availability at probe

Up until now, the necessary scm availability check has not been
performed, leading to possible null pointer dereferences (which did
happen for me on RB1).

Fix that.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-39466
https://www.cve.org/CVERecord?id=CVE-2024-39466
https://git.kernel.org/stable/c/0a47ba94ec3d8f782b33e3d970cfcb769b962464
https://git.kernel.org/stable/c/2226b145afa5e13cb60dbe77fb20fb0666a1caf3
https://git.kernel.org/stable/c/560d69c975072974c11434ca6953891e74c1a665
https://git.kernel.org/stable/c/aa1a0807b4a76b44fb6b58a7e9087cd4b18ab41b
https://git.kernel.org/stable/c/d9d3490c48df572edefc0b64655259eefdcbb9be
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-39466.mbox
https://bugzilla.redhat.com/show_bug.cgi?id=2294302

Comment 2 Andrea Mattiazzo 2024-07-01 13:40:22 UTC

All done, closing.