CVE-2024-56660

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56660
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DR, prevent potential error pointer dereference The dr_domain_add_vport_cap() function generally returns NULL on error but sometimes we want it to return ERR_PTR(-EBUSY) so the caller can retry. The problem here is that "ret" can be either -EBUSY or -ENOMEM and if it's and -ENOMEM then the error pointer is propogated back and eventually dereferenced in dr_ste_v0_build_src_gvmi_qpn_tag().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/11776cff0b563c8b8a4fa76cab620bfb633a8cb8 Patch
https://git.kernel.org/stable/c/325cf73a1b449fea3158ab99d03a7a717aad1618 Patch
https://git.kernel.org/stable/c/61f720e801443d4e2a3c0261eda4ad8431458dca Patch
https://git.kernel.org/stable/c/a59c61a1869ceefc65ef02886f91e8cd0062211f Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
History

06 Jan 2025, 18:43

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/11776cff0b563c8b8a4fa76cab620bfb633a8cb8 - () https://git.kernel.org/stable/c/11776cff0b563c8b8a4fa76cab620bfb633a8cb8 - Patch
References () https://git.kernel.org/stable/c/325cf73a1b449fea3158ab99d03a7a717aad1618 - () https://git.kernel.org/stable/c/325cf73a1b449fea3158ab99d03a7a717aad1618 - Patch
References () https://git.kernel.org/stable/c/61f720e801443d4e2a3c0261eda4ad8431458dca - () https://git.kernel.org/stable/c/61f720e801443d4e2a3c0261eda4ad8431458dca - Patch
References () https://git.kernel.org/stable/c/a59c61a1869ceefc65ef02886f91e8cd0062211f - () https://git.kernel.org/stable/c/a59c61a1869ceefc65ef02886f91e8cd0062211f - Patch
CWE CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: DR, evitar la posible desreferencia del puntero de error La función dr_domain_add_vport_cap() generalmente devuelve NULL en caso de error, pero a veces queremos que devuelva ERR_PTR(-EBUSY) para que el autor de la llamada pueda volver a intentarlo. El problema aquí es que "ret" puede ser -EBUSY o -ENOMEM y si es y -ENOMEM, entonces el puntero de error se propaga de vuelta y finalmente se desreferencia en dr_ste_v0_build_src_gvmi_qpn_tag().

27 Dec 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-27 15:15

Updated : 2025-01-06 18:43

NVD link : CVE-2024-56660

Mitre link : CVE-2024-56660

CVE.ORG link : CVE-2024-56660

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference