Bugzilla – Bug 1226760
VUL-0: CVE-2024-38611: kernel: media: i2c: et8ek8: don't strip remove function when driver is builtin
Last modified: 2024-07-08 15:13:10 UTC
In the Linux kernel, the following vulnerability has been resolved: media: i2c: et8ek8: Don't strip remove function when driver is builtin Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text) References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-38611 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-38611.mbox https://git.kernel.org/stable/c/c1a3803e5bb91c13e9ad582003e4288f67f06cd9 https://git.kernel.org/stable/c/43fff07e4b1956d0e5cf23717507e438278ea3d9 https://git.kernel.org/stable/c/904db2ba44ae60641b6378c5013254d09acf5e80 https://git.kernel.org/stable/c/545b215736c5c4b354e182d99c578a472ac9bfce https://www.cve.org/CVERecord?id=CVE-2024-38611 https://bugzilla.redhat.com/show_bug.cgi?id=2293352
Hi Takashi, Can you please take a look? 545b215736c5 ("media: i2c: et8ek8: Don't strip remove function when driver is builtin") merged vfs-6.10-rc2.fixes~64^2~246 Fixes: c5254e72b8ed ("[media] media: Driver for Toshiba et8ek8 5MP sensor") merged v4.11-rc1~132^2~118 Security fix for CVE-2024-38611 bsc#1226760 with CVSS 4.4 Experts candidates: tiwai@suse.de .......................... ACTION NEEDED! SLE12-SP5: MANUAL: backport 545b215736c5c4b354e182d99c578a472ac9bfce (Fixes c5254e72b8ed) SLE15-SP5: MANUAL: backport 545b215736c5c4b354e182d99c578a472ac9bfce (Fixes c5254e72b8ed)
This is merely a build issue and we don't build with this driver being built-in. Pushed back.