Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:

arm_mpam: Corrección de desreferencia de puntero nulo al restaurar contadores de ancho de banda

Cuando un MSC que soporta la monitorización de ancho de banda de memoria se desconecta y luego se conecta, mpam_restore_mbwu_state() llama a __ris_msmon_read() a través de ipi para restaurar la configuración de los contadores de ancho de banda. No le importa el valor leído, mbwu_arg.val, y no lo establece, lo que lleva a una desreferencia de puntero nulo cuando __ris_msmon_read() le añade. Esto resulta en un kernel oops con un rastro de llamada como:

Rastro de llamada:
__ris_msmon_read+0x19c/0x64c (P)
mpam_restore_mbwu_state+0xa0/0xe8
smp_call_on_cpu_callback+0x1c/0x38
process_one_work+0x154/0x4b4
worker_thread+0x188/0x310
kthread+0x11c/0x130
ret_from_fork+0x10/0x20

Proporcionar una variable local para val para evitar que __ris_msmon_read() desreferencie un puntero nulo al añadir a val.

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/resctrl/mpam_devices.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"41e8a14950e1732af51cfec8fa09f8ded02a5ca9","lessThan":"ac3e12bc195786d3d44d730b5b2259fd36191848","versionType":"git","status":"affected"},{"version":"41e8a14950e1732af51cfec8fa09f8ded02a5ca9","lessThan":"4ad79c874e53ebb7fe3b8ae7ac6c858a2121f415","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/resctrl/mpam_devices.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"6.19.10","lessThanOrEqual":"6.19.*","versionType":"semver","status":"unaffected"},{"version":"7.0","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476

OR
          *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19.1 up to (excluding) 6.19.10

kernel.org: https://git.kernel.org/stable/c/4ad79c874e53ebb7fe3b8ae7ac6c858a2121f415 Types: Patch

kernel.org: https://git.kernel.org/stable/c/ac3e12bc195786d3d44d730b5b2259fd36191848 Types: Patch

In the Linux kernel, the following vulnerability has been resolved:

arm_mpam: Fix null pointer dereference when restoring bandwidth counters

When an MSC supporting memory bandwidth monitoring is brought offline and
then online, mpam_restore_mbwu_state() calls __ris_msmon_read() via ipi to
restore the configuration of the bandwidth counters. It doesn't care about
the value read, mbwu_arg.val, and doesn't set it leading to a null pointer
dereference when __ris_msmon_read() adds to it. This results in a kernel
oops with a call trace such as:

Call trace:
__ris_msmon_read+0x19c/0x64c (P)
mpam_restore_mbwu_state+0xa0/0xe8
smp_call_on_cpu_callback+0x1c/0x38
process_one_work+0x154/0x4b4
worker_thread+0x188/0x310
kthread+0x11c/0x130
ret_from_fork+0x10/0x20

Provide a local variable for val to avoid __ris_msmon_read() dereferencing
a null pointer when adding to val.

https://git.kernel.org/stable/c/4ad79c874e53ebb7fe3b8ae7ac6c858a2121f415

https://git.kernel.org/stable/c/ac3e12bc195786d3d44d730b5b2259fd36191848