Bug 1222778 (CVE-2024-26784) - VUL-0: CVE-2024-26784: kernel: pmdomain: arm: Fix NULL dereference on scmi_perf_domain removal
Summary: VUL-0: CVE-2024-26784: kernel: pmdomain: arm: Fix NULL dereference on scmi_pe...
Status: RESOLVED FIXED
Alias: CVE-2024-26784
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Kernel Bugs
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/400336/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-26784:5.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-15 07:45 UTC by SMASH SMASH
Modified: 2024-04-15 07:46 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-04-15 07:45:43 UTC
In the Linux kernel, the following vulnerability has been resolved:

pmdomain: arm: Fix NULL dereference on scmi_perf_domain removal

On unloading of the scmi_perf_domain module got the below splat, when in
the DT provided to the system under test the '#power-domain-cells' property
was missing. Indeed, this particular setup causes the probe to bail out
early without giving any error, which leads to the ->remove() callback gets
to run too, but without all the expected initialized structures in place.

Add a check and bail out early on remove too.

 Call trace:
  scmi_perf_domain_remove+0x28/0x70 [scmi_perf_domain]
  scmi_dev_remove+0x28/0x40 [scmi_core]
  device_remove+0x54/0x90
  device_release_driver_internal+0x1dc/0x240
  driver_detach+0x58/0xa8
  bus_remove_driver+0x78/0x108
  driver_unregister+0x38/0x70
  scmi_driver_unregister+0x28/0x180 [scmi_core]
  scmi_perf_domain_driver_exit+0x18/0xb78 [scmi_perf_domain]
  __arm64_sys_delete_module+0x1a8/0x2c0
  invoke_syscall+0x50/0x128
  el0_svc_common.constprop.0+0x48/0xf0
  do_el0_svc+0x24/0x38
  el0_svc+0x34/0xb8
  el0t_64_sync_handler+0x100/0x130
  el0t_64_sync+0x190/0x198
 Code: a90153f3 f9403c14 f9414800 955f8a05 (b9400a80)
 ---[ end trace 0000000000000000 ]---

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26784
https://www.cve.org/CVERecord?id=CVE-2024-26784
https://git.kernel.org/stable/c/eb5555d422d0fc325e1574a7353d3c616f82d8b5
https://git.kernel.org/stable/c/f6aaf131e4d4a9a26040ecc018eb70ab8b3d355d
https://bugzilla.redhat.com/show_bug.cgi?id=2273464
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-26784.mbox
Comment 1 Alexander Bergmann 2024-04-15 07:46:20 UTC
Not affecting SLE or openSUSE kernel.