Description

In the Linux kernel, the following vulnerability has been resolved: Add exception protection processing for vd in axi_chan_handle_err function Since there is no protection for vd, a kernel panic will be triggered here in exceptional cases. You can refer to the processing of axi_chan_block_xfer_complete function The triggered kernel panic is as follows: [ 67.848444] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 [ 67.848447] Mem abort info: [ 67.848449] ESR = 0x96000004 [ 67.848451] EC = 0x25: DABT (current EL), IL = 32 bits [ 67.848454] SET = 0, FnV = 0 [ 67.848456] EA = 0, S1PTW = 0 [ 67.848458] Data abort info: [ 67.848460] ISV = 0, ISS = 0x00000004 [ 67.848462] CM = 0, WnR = 0 [ 67.848465] user pgtable: 4k pages, 48-bit VAs, pgdp=00000800c4c0b000 [ 67.848468] [0000000000000060] pgd=0000000000000000, p4d=0000000000000000 [ 67.848472] Internal error: Oops: 96000004 [#1] SMP [ 67.848475] Modules linked in: dmatest [ 67.848479] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.100-emu_x2rc+ #11 [ 67.848483] pstate: 62000085 (nZCv daIf -PAN -UAO +TCO BTYPE=--) [ 67.848487] pc : axi_chan_handle_err+0xc4/0x230 [ 67.848491] lr : axi_chan_handle_err+0x30/0x230 [ 67.848493] sp : ffff0803fe55ae50 [ 67.848495] x29: ffff0803fe55ae50 x28: ffff800011212200 [ 67.848500] x27: ffff0800c42c0080 x26: ffff0800c097c080 [ 67.848504] x25: ffff800010d33880 x24: ffff80001139d850 [ 67.848508] x23: ffff0800c097c168 x22: 0000000000000000 [ 67.848512] x21: 0000000000000080 x20: 0000000000002000 [ 67.848517] x19: ffff0800c097c080 x18: 0000000000000000 [ 67.848521] x17: 0000000000000000 x16: 0000000000000000 [ 67.848525] x15: 0000000000000000 x14: 0000000000000000 [ 67.848529] x13: 0000000000000000 x12: 0000000000000040 [ 67.848533] x11: ffff0800c0400248 x10: ffff0800c040024a [ 67.848538] x9 : ffff800010576cd4 x8 : ffff0800c0400270 [ 67.848542] x7 : 0000000000000000 x6 : ffff0800c04003e0 [ 67.848546] x5 : ffff0800c0400248 x4 : ffff0800c4294480 [ 67.848550] x3 : dead000000000100 x2 : dead000000000122 [ 67.848555] x1 : 0000000000000100 x0 : ffff0800c097c168 [ 67.848559] Call trace: [ 67.848562] axi_chan_handle_err+0xc4/0x230 [ 67.848566] dw_axi_dma_interrupt+0xf4/0x590 [ 67.848569] __handle_irq_event_percpu+0x60/0x220 [ 67.848573] handle_irq_event+0x64/0x120 [ 67.848576] handle_fasteoi_irq+0xc4/0x220 [ 67.848580] __handle_domain_irq+0x80/0xe0 [ 67.848583] gic_handle_irq+0xc0/0x138 [ 67.848585] el1_irq+0xc8/0x180 [ 67.848588] arch_cpu_idle+0x14/0x2c [ 67.848591] default_idle_call+0x40/0x16c [ 67.848594] do_idle+0x1f0/0x250 [ 67.848597] cpu_startup_entry+0x2c/0x60 [ 67.848600] rest_init+0xc0/0xcc [ 67.848603] arch_call_rest_init+0x14/0x1c [ 67.848606] start_kernel+0x4cc/0x500 [ 67.848610] Code: eb0002ff 9a9f12d6 f2fbd5a2 f2fbd5a3 (a94602c1) [ 67.848613] ---[ end trace 585a97036f88203a ]---

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  5.5 MEDIUM

Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://git.kernel.org/stable/c/20d0a6d17e85a8a816a64fa7d7cae616f1617833	Patch
https://git.kernel.org/stable/c/5054d001ffaf76155637c5e5b922c11016cd6a5d	Patch
https://git.kernel.org/stable/c/51a7ad5b60efac65691729d10745c28fa1016b96	Patch
https://git.kernel.org/stable/c/53dd833fd0a2d8f0118d01ea063a70652689d31e	Patch
https://git.kernel.org/stable/c/57054fe516d59d03a7bcf1888e82479ccc244f87	Patch
https://git.kernel.org/stable/c/f534dc438828cc3f1f8c6895b8bdfbef079521fb	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-476	NULL Pointer Dereference	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Initial Analysis by NIST 9/13/2024 9:44:43 AM

Action	Type	Old Value	New Value
Added	CVSS V3.1		NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Added	CWE		NIST CWE-476
Added	CPE Configuration		Record truncated, showing 500 of 739 characters. View Entire Change Record OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 4.19.271 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.230 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.165 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.90 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up t
Changed	Reference Type	https://git.kernel.org/stable/c/20d0a6d17e85a8a816a64fa7d7cae616f1617833 No Types Assigned	https://git.kernel.org/stable/c/20d0a6d17e85a8a816a64fa7d7cae616f1617833 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/5054d001ffaf76155637c5e5b922c11016cd6a5d No Types Assigned	https://git.kernel.org/stable/c/5054d001ffaf76155637c5e5b922c11016cd6a5d Patch
Changed	Reference Type	https://git.kernel.org/stable/c/51a7ad5b60efac65691729d10745c28fa1016b96 No Types Assigned	https://git.kernel.org/stable/c/51a7ad5b60efac65691729d10745c28fa1016b96 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/53dd833fd0a2d8f0118d01ea063a70652689d31e No Types Assigned	https://git.kernel.org/stable/c/53dd833fd0a2d8f0118d01ea063a70652689d31e Patch
Changed	Reference Type	https://git.kernel.org/stable/c/57054fe516d59d03a7bcf1888e82479ccc244f87 No Types Assigned	https://git.kernel.org/stable/c/57054fe516d59d03a7bcf1888e82479ccc244f87 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/f534dc438828cc3f1f8c6895b8bdfbef079521fb No Types Assigned	https://git.kernel.org/stable/c/f534dc438828cc3f1f8c6895b8bdfbef079521fb Patch

New CVE Received from kernel.org 8/21/2024 3:15:06 AM

Action	Type	Old Value	New Value
Added	Description		Record truncated, showing 500 of 2976 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: Add exception protection processing for vd in axi_chan_handle_err function Since there is no protection for vd, a kernel panic will be triggered here in exceptional cases. You can refer to the processing of axi_chan_block_xfer_complete function The triggered kernel panic is as follows: [ 67.848444] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 [ 67.848447] Mem abort info: [ 67.84
Added	Reference		kernel.org https://git.kernel.org/stable/c/20d0a6d17e85a8a816a64fa7d7cae616f1617833 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/5054d001ffaf76155637c5e5b922c11016cd6a5d [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/51a7ad5b60efac65691729d10745c28fa1016b96 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/53dd833fd0a2d8f0118d01ea063a70652689d31e [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/57054fe516d59d03a7bcf1888e82479ccc244f87 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/f534dc438828cc3f1f8c6895b8bdfbef079521fb [No types assigned]