OpenCVE

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add callback function pointer check before its call In dpu_core_irq_callback_handler() callback function pointer is compared to NULL, but then callback function is unconditionally called by this pointer. Fix this bug by adding conditional return. Found by Linux Verification Center (linuxtesting.org) with SVACE. Patchwork: https://patchwork.freedesktop.org/patch/588237/

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/530f272053a5e72243a9cb07bb1296af6c346002
https://git.kernel.org/stable/c/873f67699114452c2a996c4e10faac8ff860c241
https://git.kernel.org/stable/c/9078630ed7f8f25d65d11823e7f2b11a8e2f4f0f
https://lore.kernel.org/linux-cve-announce/2024062139-CVE-2024-38622-a164@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-38622
https://www.cve.org/CVERecord?id=CVE-2024-38622

History

No history.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-06-21T10:18:15.625Z

Updated: 2024-11-05T09:31:08.143Z

Reserved: 2024-06-18T19:36:34.945Z

Link: CVE-2024-38622

Vulnrichment

Updated: 2024-06-21T13:23:46.234Z

NVD

Status : Awaiting Analysis

Published: 2024-06-21T11:15:11.187

Modified: 2024-11-21T09:26:30.653

Link: CVE-2024-38622

Redhat

Severity : Low

Publid Date: 2024-06-21T00:00:00Z

Links: CVE-2024-38622 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38622", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.945Z", "datePublished": "2024-06-21T10:18:15.625Z", "dateUpdated": "2024-11-05T09:31:08.143Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:31:08.143Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: Add callback function pointer check before its call\n\nIn dpu_core_irq_callback_handler() callback function pointer is compared to NULL,\nbut then callback function is unconditionally called by this pointer.\nFix this bug by adding conditional return.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\nPatchwork: https://patchwork.freedesktop.org/patch/588237/"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c"], "versions": [{"version": "c929ac60b3ed", "lessThan": "873f67699114", "status": "affected", "versionType": "git"}, {"version": "c929ac60b3ed", "lessThan": "9078630ed7f8", "status": "affected", "versionType": "git"}, {"version": "c929ac60b3ed", "lessThan": "530f272053a5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.4", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/873f67699114452c2a996c4e10faac8ff860c241"}, {"url": "https://git.kernel.org/stable/c/9078630ed7f8f25d65d11823e7f2b11a8e2f4f0f"}, {"url": "https://git.kernel.org/stable/c/530f272053a5e72243a9cb07bb1296af6c346002"}], "title": "drm/msm/dpu: Add callback function pointer check before its call", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-21T13:23:40.246723Z", "id": "CVE-2024-38622", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-21T13:23:53.817Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:26.011Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/873f67699114452c2a996c4e10faac8ff860c241", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9078630ed7f8f25d65d11823e7f2b11a8e2f4f0f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/530f272053a5e72243a9cb07bb1296af6c346002", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38622", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-21T13:23:40.246723Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-21T13:23:46.234Z"}}], "cna": {"title": "drm/msm/dpu: Add callback function pointer check before its call", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c929ac60b3ed", "lessThan": "873f67699114", "versionType": "git"}, {"status": "affected", "version": "c929ac60b3ed", "lessThan": "9078630ed7f8", "versionType": "git"}, {"status": "affected", "version": "c929ac60b3ed", "lessThan": "530f272053a5", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"status": "unaffected", "version": "0", "lessThan": "5.19", "versionType": "custom"}, {"status": "unaffected", "version": "6.6.33", "versionType": "custom", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.4", "versionType": "custom", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/873f67699114452c2a996c4e10faac8ff860c241"}, {"url": "https://git.kernel.org/stable/c/9078630ed7f8f25d65d11823e7f2b11a8e2f4f0f"}, {"url": "https://git.kernel.org/stable/c/530f272053a5e72243a9cb07bb1296af6c346002"}], "x_generator": {"engine": "bippy-c9c4e1df01b2"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: Add callback function pointer check before its call\n\nIn dpu_core_irq_callback_handler() callback function pointer is compared to NULL,\nbut then callback function is unconditionally called by this pointer.\nFix this bug by adding conditional return.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\nPatchwork: https://patchwork.freedesktop.org/patch/588237/"}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-15T06:49:15.899Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38622", "state": "PUBLISHED", "dateUpdated": "2024-07-15T06:49:15.899Z", "dateReserved": "2024-06-18T19:36:34.945Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-21T10:18:15.625Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}