CVE-2024-47141 pinmux: Use sequential access to access desc->pinmux data
A race condition in the Linux kernel pinmux subsystem can cause a NULL pointer dereference and system crash when multiple processes access pin states concurrently.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47141?
CVE-2024-47141 is a medium-severity vulnerability in Linux kernel, published on 11 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
pinmux: Use sequential access to access desc->pinmux data
When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner.
Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer.
Serialize the access to mux related setting with a mutex lock.
cpu0 (process A) cpu1(process B)
pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) {
if (desc->mux_usecount > 1) return 0; desc->mux_owner = owner;
} }
Weakness: CWE-667
Which versions are affected by CVE-2024-47141?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-47141?
Apply the vendor's patch.
Is CVE-2024-47141 being exploited?
There is no known exploitation of CVE-2024-47141 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-56143, AZL-56187, BELL-CVE-2024-47141, DEBIAN-CVE-2024-47141, GHSA-ff75-3hc4-j344, ROOT-OS-DEBIAN-11-CVE-2024-47141 and 3 more.