CVE - CVE-2024-35902

CVE-ID
CVE-2024-35902	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null dereference cp might be null, calling cp->cp_conn would produce null dereference [Simon Horman adds:] Analysis: * cp is a parameter of __rds_rdma_map and is not reassigned. * The following call-sites pass a NULL cp argument to __rds_rdma_map() - rds_get_mr() - rds_get_mr_for_dest * Prior to the code above, the following assumes that cp may be NULL (which is indicative, but could itself be unnecessary) trans_private = rs->rs_transport->get_mr( sg, nents, rs, &mr->r_key, cp ? cp->cp_conn : NULL, args->vec.addr, args->vec.bytes, need_odp ? ODP_ZEROBASED : ODP_NOT_NEEDED); * The code modified by this patch is guarded by IS_ERR(trans_private), where trans_private is assigned as per the previous point in this analysis. The only implementation of get_mr that I could locate is rds_ib_get_mr() which can return an ERR_PTR if the conn (4th) argument is NULL. * ret is set to PTR_ERR(trans_private). rds_ib_get_mr can return ERR_PTR(-ENODEV) if the conn (4th) argument is NULL. Thus ret may be -ENODEV in which case the code in question will execute. Conclusion: * cp may be NULL at the point where this patch adds a check; this patch does seem to address a possible bug
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/62fc3357e079a07a22465b9b6ef71bb6ea75ee4b URL:https://git.kernel.org/stable/c/62fc3357e079a07a22465b9b6ef71bb6ea75ee4b MISC:https://git.kernel.org/stable/c/6794090c742008c53b344b35b021d4a3093dc50a URL:https://git.kernel.org/stable/c/6794090c742008c53b344b35b021d4a3093dc50a MISC:https://git.kernel.org/stable/c/92309bed3c5fbe2ccd4c45056efd42edbd06162d URL:https://git.kernel.org/stable/c/92309bed3c5fbe2ccd4c45056efd42edbd06162d MISC:https://git.kernel.org/stable/c/bcd46782e2ec3825d10c1552fcb674d491cc09f9 URL:https://git.kernel.org/stable/c/bcd46782e2ec3825d10c1552fcb674d491cc09f9 MISC:https://git.kernel.org/stable/c/cbaac2e5488ed54833897264a5ffb2a341a9f196 URL:https://git.kernel.org/stable/c/cbaac2e5488ed54833897264a5ffb2a341a9f196 MISC:https://git.kernel.org/stable/c/cfb786b03b03c5ff38882bee38525eb9987e4d14 URL:https://git.kernel.org/stable/c/cfb786b03b03c5ff38882bee38525eb9987e4d14 MISC:https://git.kernel.org/stable/c/d275de8ea7be3a453629fddae41d4156762e814c URL:https://git.kernel.org/stable/c/d275de8ea7be3a453629fddae41d4156762e814c MISC:https://git.kernel.org/stable/c/d49fac38479bfdaec52b3ea274d290c47a294029 URL:https://git.kernel.org/stable/c/d49fac38479bfdaec52b3ea274d290c47a294029 MLIST:[debian-lts-announce] 20240625 [SECURITY] [DLA 3842-1] linux-5.10 security update URL:https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html MLIST:[debian-lts-announce] 20240627 [SECURITY] [DLA 3840-1] linux security update URL:https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
Assigning CNA
kernel.org
Date Record Created
20240517	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240517)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)