pinmux: Use sequential access to access desc->pinmux data
Impact
In the Linux kernel, the following vulnerability has been resolved:
Source excerpt · LinuxAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Linux · Linux
Linux
4 ranges
Linux · Linux
Linux
Compare with this publisher’s ranges. This does not inspect your installation.
affected
42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 → before d25e45dcf8e32062f7935e4ba154869043812ab6
git versions
42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 → before 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b
git versions
42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 → before c11e2ec9a780f54982a187ee10ffd1b810715c85
git versions
42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 → before 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e
git versions
Other versions: unaffected
Linux · Linux
Linux
6 ranges
Linux · Linux
Linux
Compare with this publisher’s ranges. This does not inspect your installation.
affected
3.10
unaffected
0 → before 3.10
semver versions
6.1.191 → through 6.1.*
semver versions
6.6.66 → through 6.6.*
semver versions
6.12.5 → through 6.12.*
semver versions
6.13 → through *
original_commit_for_fix versions
Other versions: affected
Original source description
In the Linux kernel, the following vulnerability has been resolved:
pinmux: Use sequential access to access desc->pinmux data
When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner.
Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer.
Serialize the access to mux related setting with a mutex lock.
cpu0 (process A) cpu1(process B)
pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) {
if (desc->mux_usecount > 1)
return 0;
desc->mux_owner = owner;
} }
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2024-47141View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
Linux · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 3.10
Before: 6.1.191
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 3.10
Before: 6.6.66
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 3.10
Before: 6.12.5
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 3.10
Before: 6.13
Original applicability statements
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10",
"versionEndExcluding": "6.1.191"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10",
"versionEndExcluding": "6.6.66"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10",
"versionEndExcluding": "6.12.5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10",
"versionEndExcluding": "6.13"
}
]
}
]
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.