CVE-2024-43824 PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
A redundant NULL check removal in the Linux kernel PCI endpoint test function could theoretically lead to a null pointer dereference, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43824?
CVE-2024-43824 is a medium-severity vulnerability in Linux kernel, published on 17 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
Instead of getting the epc_features from pci_epc_get_features() API, use the cached pci_epf_test::epc_features value to avoid the NULL check. Since the NULL check is already performed in pci_epf_test_bind(), having one more check in pci_epf_test_core_init() is redundant and it is not possible to hit the NULL pointer dereference.
Also with commit a01e7214bef9 ("PCI: endpoint: Remove "core_init_notifier" flag"), 'epc_features' got dereferenced without the NULL check, leading to the following false positive Smatch warning:
drivers/pci/endpoint/functions/pci-epf-test.c:784 pci_epf_test_core_init() error: we previously assumed 'epc_features' could be null (see line 747)
Thus, remove the redundant NULL check and also use the epc_features:: {msix_capable/msi_capable} flags directly to avoid local variables.
[kwilczynski: commit log]
Weakness: CWE-476
Which versions are affected by CVE-2024-43824?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-43824?
Apply the vendor's patch.
Is CVE-2024-43824 being exploited?
There is no known exploitation of CVE-2024-43824 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-48501, AZL-48514, BELL-CVE-2024-43824, DEBIAN-CVE-2024-43824, GHSA-79w7-7m7g-wmx3, ROOT-OS-DEBIAN-11-CVE-2024-43824 and 3 more.