cve-2024-35902
Vulnerability from cvelistv5
Published
2024-05-19 08:34
Modified
2024-08-02 03:21
Severity
Summary
net/rds: fix possible cp null dereference
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/62fc3357e079a07a22465b9b6ef71bb6ea75ee4b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6794090c742008c53b344b35b021d4a3093dc50a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/92309bed3c5fbe2ccd4c45056efd42edbd06162d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bcd46782e2ec3825d10c1552fcb674d491cc09f9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cbaac2e5488ed54833897264a5ffb2a341a9f196
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cfb786b03b03c5ff38882bee38525eb9987e4d14
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d275de8ea7be3a453629fddae41d4156762e814c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d49fac38479bfdaec52b3ea274d290c47a294029
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35902",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T14:09:14.303997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:18.553Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.670Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d275de8ea7be3a453629fddae41d4156762e814c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bcd46782e2ec3825d10c1552fcb674d491cc09f9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cfb786b03b03c5ff38882bee38525eb9987e4d14"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d49fac38479bfdaec52b3ea274d290c47a294029"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cbaac2e5488ed54833897264a5ffb2a341a9f196"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/92309bed3c5fbe2ccd4c45056efd42edbd06162d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6794090c742008c53b344b35b021d4a3093dc50a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/62fc3357e079a07a22465b9b6ef71bb6ea75ee4b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rds/rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d275de8ea7be",
              "status": "affected",
              "version": "786854141057",
              "versionType": "git"
            },
            {
              "lessThan": "bcd46782e2ec",
              "status": "affected",
              "version": "997efea2bf3a",
              "versionType": "git"
            },
            {
              "lessThan": "cfb786b03b03",
              "status": "affected",
              "version": "9dfc15a10dfd",
              "versionType": "git"
            },
            {
              "lessThan": "d49fac38479b",
              "status": "affected",
              "version": "b562ebe21ed9",
              "versionType": "git"
            },
            {
              "lessThan": "cbaac2e5488e",
              "status": "affected",
              "version": "998fd719e6d6",
              "versionType": "git"
            },
            {
              "lessThan": "92309bed3c5f",
              "status": "affected",
              "version": "2b505d052807",
              "versionType": "git"
            },
            {
              "lessThan": "6794090c7420",
              "status": "affected",
              "version": "c055fc00c07b",
              "versionType": "git"
            },
            {
              "lessThan": "62fc3357e079",
              "status": "affected",
              "version": "c055fc00c07b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rds/rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.85",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: fix possible cp null dereference\n\ncp might be null, calling cp-\u003ecp_conn would produce null dereference\n\n[Simon Horman adds:]\n\nAnalysis:\n\n* cp is a parameter of __rds_rdma_map and is not reassigned.\n\n* The following call-sites pass a NULL cp argument to __rds_rdma_map()\n\n  - rds_get_mr()\n  - rds_get_mr_for_dest\n\n* Prior to the code above, the following assumes that cp may be NULL\n  (which is indicative, but could itself be unnecessary)\n\n\ttrans_private = rs-\u003ers_transport-\u003eget_mr(\n\t\tsg, nents, rs, \u0026mr-\u003er_key, cp ? cp-\u003ecp_conn : NULL,\n\t\targs-\u003evec.addr, args-\u003evec.bytes,\n\t\tneed_odp ? ODP_ZEROBASED : ODP_NOT_NEEDED);\n\n* The code modified by this patch is guarded by IS_ERR(trans_private),\n  where trans_private is assigned as per the previous point in this analysis.\n\n  The only implementation of get_mr that I could locate is rds_ib_get_mr()\n  which can return an ERR_PTR if the conn (4th) argument is NULL.\n\n* ret is set to PTR_ERR(trans_private).\n  rds_ib_get_mr can return ERR_PTR(-ENODEV) if the conn (4th) argument is NULL.\n  Thus ret may be -ENODEV in which case the code in question will execute.\n\nConclusion:\n* cp may be NULL at the point where this patch adds a check;\n  this patch does seem to address a possible bug"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:30:59.238Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d275de8ea7be3a453629fddae41d4156762e814c"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcd46782e2ec3825d10c1552fcb674d491cc09f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfb786b03b03c5ff38882bee38525eb9987e4d14"
        },
        {
          "url": "https://git.kernel.org/stable/c/d49fac38479bfdaec52b3ea274d290c47a294029"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbaac2e5488ed54833897264a5ffb2a341a9f196"
        },
        {
          "url": "https://git.kernel.org/stable/c/92309bed3c5fbe2ccd4c45056efd42edbd06162d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6794090c742008c53b344b35b021d4a3093dc50a"
        },
        {
          "url": "https://git.kernel.org/stable/c/62fc3357e079a07a22465b9b6ef71bb6ea75ee4b"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
        }
      ],
      "title": "net/rds: fix possible cp null dereference",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35902",
    "datePublished": "2024-05-19T08:34:55.692Z",
    "dateReserved": "2024-05-17T13:50:33.114Z",
    "dateUpdated": "2024-08-02T03:21:48.670Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35902\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T09:15:11.037\",\"lastModified\":\"2024-06-27T12:15:26.087\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/rds: fix possible cp null dereference\\n\\ncp might be null, calling cp-\u003ecp_conn would produce null dereference\\n\\n[Simon Horman adds:]\\n\\nAnalysis:\\n\\n* cp is a parameter of __rds_rdma_map and is not reassigned.\\n\\n* The following call-sites pass a NULL cp argument to __rds_rdma_map()\\n\\n  - rds_get_mr()\\n  - rds_get_mr_for_dest\\n\\n* Prior to the code above, the following assumes that cp may be NULL\\n  (which is indicative, but could itself be unnecessary)\\n\\n\\ttrans_private = rs-\u003ers_transport-\u003eget_mr(\\n\\t\\tsg, nents, rs, \u0026mr-\u003er_key, cp ? cp-\u003ecp_conn : NULL,\\n\\t\\targs-\u003evec.addr, args-\u003evec.bytes,\\n\\t\\tneed_odp ? ODP_ZEROBASED : ODP_NOT_NEEDED);\\n\\n* The code modified by this patch is guarded by IS_ERR(trans_private),\\n  where trans_private is assigned as per the previous point in this analysis.\\n\\n  The only implementation of get_mr that I could locate is rds_ib_get_mr()\\n  which can return an ERR_PTR if the conn (4th) argument is NULL.\\n\\n* ret is set to PTR_ERR(trans_private).\\n  rds_ib_get_mr can return ERR_PTR(-ENODEV) if the conn (4th) argument is NULL.\\n  Thus ret may be -ENODEV in which case the code in question will execute.\\n\\nConclusion:\\n* cp may be NULL at the point where this patch adds a check;\\n  this patch does seem to address a possible bug\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/rds: corrige la posible desreferencia nula de cp cp podr\u00eda ser nulo, llamar a cp-\u0026gt;cp_conn producir\u00eda una desreferencia nula [Simon Horman agrega:] An\u00e1lisis: * cp es un par\u00e1metro de __rds_rdma_map y no es reasignado. * Los siguientes sitios de llamadas pasan un argumento cp NULL a __rds_rdma_map() - rds_get_mr() - rds_get_mr_for_dest * Antes del c\u00f3digo anterior, lo siguiente supone que cp puede ser NULL (lo cual es indicativo, pero podr\u00eda ser innecesario) trans_private = rs -\u0026gt;rs_transport-\u0026gt;get_mr( sg, nents, rs, \u0026amp;mr-\u0026gt;r_key, cp ? cp-\u0026gt;cp_conn : NULL, args-\u0026gt;vec.addr, args-\u0026gt;vec.bytes, need_odp ? ODP_ZEROBASED : ODP_NOT_NEEDED); * El c\u00f3digo modificado por este parche est\u00e1 custodiado por IS_ERR(trans_private), donde trans_private se asigna seg\u00fan el punto anterior de este an\u00e1lisis. La \u00fanica implementaci\u00f3n de get_mr que pude localizar es rds_ib_get_mr() que puede devolver un ERR_PTR si el argumento conn (cuarto) es NULL. * ret est\u00e1 establecido en PTR_ERR(trans_private). rds_ib_get_mr puede devolver ERR_PTR(-ENODEV) si el argumento de conexi\u00f3n (cuarto) es NULL. Por lo tanto, ret puede ser -ENODEV, en cuyo caso se ejecutar\u00e1 el c\u00f3digo en cuesti\u00f3n. Conclusi\u00f3n: * cp puede ser NULL en el punto donde este parche agrega una verificaci\u00f3n; este parche parece solucionar un posible error \"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/62fc3357e079a07a22465b9b6ef71bb6ea75ee4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6794090c742008c53b344b35b021d4a3093dc50a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/92309bed3c5fbe2ccd4c45056efd42edbd06162d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bcd46782e2ec3825d10c1552fcb674d491cc09f9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cbaac2e5488ed54833897264a5ffb2a341a9f196\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cfb786b03b03c5ff38882bee38525eb9987e4d14\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d275de8ea7be3a453629fddae41d4156762e814c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d49fac38479bfdaec52b3ea274d290c47a294029\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.