CVE-2024-47705

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-47705
In the Linux kernel, the following vulnerability has been resolved: block: fix potential invalid pointer dereference in blk_add_partition The blk_add_partition() function initially used a single if-condition (IS_ERR(part)) to check for errors when adding a partition. This was modified to handle the specific case of -ENXIO separately, allowing the function to proceed without logging the error in this case. However, this change unintentionally left a path where md_autodetect_dev() could be called without confirming that part is a valid pointer. This commit separates the error handling logic by splitting the initial if-condition, improving code readability and handling specific error scenarios explicitly. The function now distinguishes the general error case from -ENXIO without altering the existing behavior of md_autodetect_dev() calls.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/26e197b7f9240a4ac301dd0ad520c0c697c2ea7d Patch
https://git.kernel.org/stable/c/4bc4272e2506941c3f3d4fb8b0c659ee814dcf6f Patch
https://git.kernel.org/stable/c/64cf2a39202ca2d9df5ee70eb310b6141ce2b8ed Patch
https://git.kernel.org/stable/c/652039ba477c9a4ab43740cf2cb0d068d53508c2 Patch
https://git.kernel.org/stable/c/80f5bfbb80ea1615290dbc24f49d3d8c86db58fe Patch
https://git.kernel.org/stable/c/afe53ea9b378c376101d99d216f13b6256f75189 Patch
https://git.kernel.org/stable/c/cc4d21d9492db4e534d3e01253cf885c90dd2a8b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

24 Oct 2024, 13:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: block: fix potential no valid pointer dereference in blk_add_partition La función blk_add_partition() inicialmente usaba una sola condición if (IS_ERR(part)) para verificar errores al agregar una partición. Esto se modificó para manejar el caso específico de -ENXIO por separado, lo que permite que la función continúe sin registrar el error en este caso. Sin embargo, este cambio dejó involuntariamente una ruta donde se podía llamar a md_autodetect_dev() sin confirmar que part es un puntero válido. Esta confirmación separa la lógica de manejo de errores al dividir la condición if inicial, lo que mejora la legibilidad del código y maneja escenarios de error específicos de manera explícita. La función ahora distingue el caso de error general de -ENXIO sin alterar el comportamiento existente de las llamadas a md_autodetect_dev().
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/26e197b7f9240a4ac301dd0ad520c0c697c2ea7d - () https://git.kernel.org/stable/c/26e197b7f9240a4ac301dd0ad520c0c697c2ea7d - Patch
References () https://git.kernel.org/stable/c/4bc4272e2506941c3f3d4fb8b0c659ee814dcf6f - () https://git.kernel.org/stable/c/4bc4272e2506941c3f3d4fb8b0c659ee814dcf6f - Patch
References () https://git.kernel.org/stable/c/64cf2a39202ca2d9df5ee70eb310b6141ce2b8ed - () https://git.kernel.org/stable/c/64cf2a39202ca2d9df5ee70eb310b6141ce2b8ed - Patch
References () https://git.kernel.org/stable/c/652039ba477c9a4ab43740cf2cb0d068d53508c2 - () https://git.kernel.org/stable/c/652039ba477c9a4ab43740cf2cb0d068d53508c2 - Patch
References () https://git.kernel.org/stable/c/80f5bfbb80ea1615290dbc24f49d3d8c86db58fe - () https://git.kernel.org/stable/c/80f5bfbb80ea1615290dbc24f49d3d8c86db58fe - Patch
References () https://git.kernel.org/stable/c/afe53ea9b378c376101d99d216f13b6256f75189 - () https://git.kernel.org/stable/c/afe53ea9b378c376101d99d216f13b6256f75189 - Patch
References () https://git.kernel.org/stable/c/cc4d21d9492db4e534d3e01253cf885c90dd2a8b - () https://git.kernel.org/stable/c/cc4d21d9492db4e534d3e01253cf885c90dd2a8b - Patch

21 Oct 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-21 12:15

Updated : 2024-10-24 13:35

NVD link : CVE-2024-47705

Mitre link : CVE-2024-47705

CVE.ORG link : CVE-2024-47705

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference