cve-2024-27027
Vulnerability from cvelistv5
Published
2024-05-01 12:49
Modified
2024-12-19 08:52
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpll_xa_ref_*_del() for multiple registrations Currently, if there are multiple registrations of the same pin on the same dpll device, following warnings are observed: WARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:143 dpll_xa_ref_pin_del.isra.0+0x21e/0x230 WARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:223 __dpll_pin_unregister+0x2b3/0x2c0 The problem is, that in both dpll_xa_ref_dpll_del() and dpll_xa_ref_pin_del() registration is only removed from list in case the reference count drops to zero. That is wrong, the registration has to be removed always. To fix this, remove the registration from the list and free it unconditionally, instead of doing it only when the ref reference counter reaches zero.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/769324eb35143462542cdb15483cdaf4877bf661
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b27e32e9367dac024cd6f61f22655714f483fd67
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b446631f355ece73b13c311dd712c47381a23172
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/769324eb35143462542cdb15483cdaf4877bf661
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b27e32e9367dac024cd6f61f22655714f483fd67
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b446631f355ece73b13c311dd712c47381a23172
Impacted products
Vendor Product Version
Linux Linux Version: 6.7
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.947Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/769324eb35143462542cdb15483cdaf4877bf661"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b27e32e9367dac024cd6f61f22655714f483fd67"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b446631f355ece73b13c311dd712c47381a23172"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:44:27.551263Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:34.801Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dpll/dpll_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "769324eb35143462542cdb15483cdaf4877bf661",
              "status": "affected",
              "version": "9431063ad323ac864750aeba4d304389bc42ca4e",
              "versionType": "git"
            },
            {
              "lessThan": "b27e32e9367dac024cd6f61f22655714f483fd67",
              "status": "affected",
              "version": "9431063ad323ac864750aeba4d304389bc42ca4e",
              "versionType": "git"
            },
            {
              "lessThan": "b446631f355ece73b13c311dd712c47381a23172",
              "status": "affected",
              "version": "9431063ad323ac864750aeba4d304389bc42ca4e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dpll/dpll_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpll: fix dpll_xa_ref_*_del() for multiple registrations\n\nCurrently, if there are multiple registrations of the same pin on the\nsame dpll device, following warnings are observed:\nWARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:143 dpll_xa_ref_pin_del.isra.0+0x21e/0x230\nWARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:223 __dpll_pin_unregister+0x2b3/0x2c0\n\nThe problem is, that in both dpll_xa_ref_dpll_del() and\ndpll_xa_ref_pin_del() registration is only removed from list in case the\nreference count drops to zero. That is wrong, the registration has to\nbe removed always.\n\nTo fix this, remove the registration from the list and free\nit unconditionally, instead of doing it only when the ref reference\ncounter reaches zero."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:52:52.808Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/769324eb35143462542cdb15483cdaf4877bf661"
        },
        {
          "url": "https://git.kernel.org/stable/c/b27e32e9367dac024cd6f61f22655714f483fd67"
        },
        {
          "url": "https://git.kernel.org/stable/c/b446631f355ece73b13c311dd712c47381a23172"
        }
      ],
      "title": "dpll: fix dpll_xa_ref_*_del() for multiple registrations",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27027",
    "datePublished": "2024-05-01T12:49:35.130Z",
    "dateReserved": "2024-02-19T14:20:24.210Z",
    "dateUpdated": "2024-12-19T08:52:52.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27027\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T13:15:48.987\",\"lastModified\":\"2024-11-21T09:03:41.650\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndpll: fix dpll_xa_ref_*_del() for multiple registrations\\n\\nCurrently, if there are multiple registrations of the same pin on the\\nsame dpll device, following warnings are observed:\\nWARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:143 dpll_xa_ref_pin_del.isra.0+0x21e/0x230\\nWARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:223 __dpll_pin_unregister+0x2b3/0x2c0\\n\\nThe problem is, that in both dpll_xa_ref_dpll_del() and\\ndpll_xa_ref_pin_del() registration is only removed from list in case the\\nreference count drops to zero. That is wrong, the registration has to\\nbe removed always.\\n\\nTo fix this, remove the registration from the list and free\\nit unconditionally, instead of doing it only when the ref reference\\ncounter reaches zero.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dpll: corrige dpll_xa_ref_*_del() para m\u00faltiples registros Actualmente, si hay m\u00faltiples registros del mismo pin en el mismo dispositivo dpll, se observan las siguientes advertencias: ADVERTENCIA: CPU: 5 PID: 2212 en drivers/dpll/dpll_core.c:143 dpll_xa_ref_pin_del.isra.0+0x21e/0x230 ADVERTENCIA: CPU: 5 PID: 2212 en drivers/dpll/dpll_core.c:223 __dpll_pin_unregister+0x2b3/0x2c0 El problema es que Tanto en dpll_xa_ref_dpll_del() como en dpll_xa_ref_pin_del() el registro solo se elimina de la lista en caso de que el recuento de referencias caiga a cero. Eso est\u00e1 mal, siempre hay que eliminar el registro. Para solucionar este problema, elimine el registro de la lista y lib\u00e9relo incondicionalmente, en lugar de hacerlo s\u00f3lo cuando el contador de referencia de referencia llegue a cero.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/769324eb35143462542cdb15483cdaf4877bf661\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b27e32e9367dac024cd6f61f22655714f483fd67\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b446631f355ece73b13c311dd712c47381a23172\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/769324eb35143462542cdb15483cdaf4877bf661\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/b27e32e9367dac024cd6f61f22655714f483fd67\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/b446631f355ece73b13c311dd712c47381a23172\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.