CVE-2024-35984

i2c: smbus: fix NULL function pointer dereference

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

i2c: smbus: fix NULL function pointer dereference

Baruch reported an OOPS when using the designware controller as target
only. Target-only modes break the assumption of one transfer function
always being available. Fix this by always checking the pointer in
__i2c_transfer.

[wsa: dropped the simplification in core-smbus to avoid theoretical regressions]

En el kernel de Linux, se resolvió la siguiente vulnerabilidad: i2c: smbus: corrige la desreferencia del puntero de función NULL. Baruch informó de un OOPS al usar el controlador de designware como destino únicamente. Los modos de solo objetivo rompen el supuesto de que siempre hay una función de transferencia disponible. Solucione este problema comprobando siempre el puntero en __i2c_transfer. [wsa: abandonó la simplificación en core-smbus para evitar regresiones teóricas]

*Credits: N/A

CVSS Scores

NISTv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-17 CVE Reserved
2024-05-20 CVE Published
2024-05-24 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-476: NULL Pointer Dereference

CAPEC

References (11)

URL	Tag	Source
https://git.kernel.org/stable/c/63453b59e41173241c4efe9335815f6432fa8586	Vuln. Introduced
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/40f1d79f07b49c8a64a861706e5163f2db4bd95d	2024-05-02
https://git.kernel.org/stable/c/ad3c3ac7a03be3697114f781193dd3e9d97e6e23	2024-05-02
https://git.kernel.org/stable/c/5fd72404587d7db4acb2d241fd8c387afb0a7aec	2024-05-02
https://git.kernel.org/stable/c/5a09eae9a7db597fe0c1fc91636205b4a25d2620	2024-05-02
https://git.kernel.org/stable/c/4e75e222d397c6752b229ed72fc4644c8c36ecde	2024-05-02
https://git.kernel.org/stable/c/e3425674ff68dc521c57c6eabad0cbd20a027d85	2024-05-02
https://git.kernel.org/stable/c/357c64ef1ef39b1e7cd91ab6bdd304d043702c83	2024-05-02
https://git.kernel.org/stable/c/91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f	2024-04-27

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.19 < 4.19.313 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.19 < 4.19.313"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.19 < 5.4.275 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.19 < 5.4.275"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.19 < 5.10.216 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.19 < 5.10.216"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.19 < 5.15.158 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.19 < 5.15.158"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.19 < 6.1.90 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.19 < 6.1.90"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.19 < 6.6.30 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.19 < 6.6.30"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.19 < 6.8.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.19 < 6.8.9"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.19 < 6.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.19 < 6.9"		en		Affected