cve-2024-27027
Vulnerability from cvelistv5
Published
2024-05-01 12:49
Modified
2024-09-11 17:33
Severity
Summary
dpll: fix dpll_xa_ref_*_del() for multiple registrations
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/769324eb35143462542cdb15483cdaf4877bf661
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b27e32e9367dac024cd6f61f22655714f483fd67
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b446631f355ece73b13c311dd712c47381a23172
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.947Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/769324eb35143462542cdb15483cdaf4877bf661"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b27e32e9367dac024cd6f61f22655714f483fd67"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b446631f355ece73b13c311dd712c47381a23172"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:44:27.551263Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:34.801Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dpll/dpll_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "769324eb3514",
              "status": "affected",
              "version": "9431063ad323",
              "versionType": "git"
            },
            {
              "lessThan": "b27e32e9367d",
              "status": "affected",
              "version": "9431063ad323",
              "versionType": "git"
            },
            {
              "lessThan": "b446631f355e",
              "status": "affected",
              "version": "9431063ad323",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dpll/dpll_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpll: fix dpll_xa_ref_*_del() for multiple registrations\n\nCurrently, if there are multiple registrations of the same pin on the\nsame dpll device, following warnings are observed:\nWARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:143 dpll_xa_ref_pin_del.isra.0+0x21e/0x230\nWARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:223 __dpll_pin_unregister+0x2b3/0x2c0\n\nThe problem is, that in both dpll_xa_ref_dpll_del() and\ndpll_xa_ref_pin_del() registration is only removed from list in case the\nreference count drops to zero. That is wrong, the registration has to\nbe removed always.\n\nTo fix this, remove the registration from the list and free\nit unconditionally, instead of doing it only when the ref reference\ncounter reaches zero."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:27:16.302Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/769324eb35143462542cdb15483cdaf4877bf661"
        },
        {
          "url": "https://git.kernel.org/stable/c/b27e32e9367dac024cd6f61f22655714f483fd67"
        },
        {
          "url": "https://git.kernel.org/stable/c/b446631f355ece73b13c311dd712c47381a23172"
        }
      ],
      "title": "dpll: fix dpll_xa_ref_*_del() for multiple registrations",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27027",
    "datePublished": "2024-05-01T12:49:35.130Z",
    "dateReserved": "2024-02-19T14:20:24.210Z",
    "dateUpdated": "2024-09-11T17:33:34.801Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27027\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T13:15:48.987\",\"lastModified\":\"2024-05-01T19:50:25.633\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndpll: fix dpll_xa_ref_*_del() for multiple registrations\\n\\nCurrently, if there are multiple registrations of the same pin on the\\nsame dpll device, following warnings are observed:\\nWARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:143 dpll_xa_ref_pin_del.isra.0+0x21e/0x230\\nWARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:223 __dpll_pin_unregister+0x2b3/0x2c0\\n\\nThe problem is, that in both dpll_xa_ref_dpll_del() and\\ndpll_xa_ref_pin_del() registration is only removed from list in case the\\nreference count drops to zero. That is wrong, the registration has to\\nbe removed always.\\n\\nTo fix this, remove the registration from the list and free\\nit unconditionally, instead of doing it only when the ref reference\\ncounter reaches zero.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dpll: corrige dpll_xa_ref_*_del() para m\u00faltiples registros Actualmente, si hay m\u00faltiples registros del mismo pin en el mismo dispositivo dpll, se observan las siguientes advertencias: ADVERTENCIA: CPU: 5 PID: 2212 en drivers/dpll/dpll_core.c:143 dpll_xa_ref_pin_del.isra.0+0x21e/0x230 ADVERTENCIA: CPU: 5 PID: 2212 en drivers/dpll/dpll_core.c:223 __dpll_pin_unregister+0x2b3/0x2c0 El problema es que Tanto en dpll_xa_ref_dpll_del() como en dpll_xa_ref_pin_del() el registro solo se elimina de la lista en caso de que el recuento de referencias caiga a cero. Eso est\u00e1 mal, siempre hay que eliminar el registro. Para solucionar este problema, elimine el registro de la lista y lib\u00e9relo incondicionalmente, en lugar de hacerlo s\u00f3lo cuando el contador de referencia de referencia llegue a cero.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/769324eb35143462542cdb15483cdaf4877bf661\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b27e32e9367dac024cd6f61f22655714f483fd67\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b446631f355ece73b13c311dd712c47381a23172\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.