In the Linux kernel, the following vulnerability has been resolved: Input: adp5589-keys - fix NULL pointer dereference We register a devm action to call adp5589_clear_config() and then pass the i2c client as argument so that we can call i2c_get_clientdata() in order to get our device object. However, i2c_set_clientdata() is only being set at the end of the probe function which means that we'll get a NULL pointer dereference in case the probe function fails early.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/122b160561f6429701a0559a0f39b0ae309488c6 cve-icon cve-icon
https://git.kernel.org/stable/c/34e304cc53ae5d3c8e3f08b41dd11e0d4f3e01ed cve-icon cve-icon
https://git.kernel.org/stable/c/4449fedb8a710043fc0925409eba844c192d4337 cve-icon cve-icon
https://git.kernel.org/stable/c/7c3f04223aaf82489472d614c6decee5a1ce8d7f cve-icon cve-icon
https://git.kernel.org/stable/c/9a38791ee79bd17d225c15a6d1479448be127a59 cve-icon cve-icon
https://git.kernel.org/stable/c/fb5cc65f973661241e4a2b7390b429aa7b330c69 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024102114-CVE-2024-49871-1293@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-49871 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-49871 cve-icon
History

Thu, 24 Oct 2024 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-476
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Tue, 22 Oct 2024 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Oct 2024 13:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Mon, 21 Oct 2024 18:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Input: adp5589-keys - fix NULL pointer dereference We register a devm action to call adp5589_clear_config() and then pass the i2c client as argument so that we can call i2c_get_clientdata() in order to get our device object. However, i2c_set_clientdata() is only being set at the end of the probe function which means that we'll get a NULL pointer dereference in case the probe function fails early.
Title Input: adp5589-keys - fix NULL pointer dereference
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-10-21T18:01:12.711Z

Updated: 2024-11-05T09:50:27.966Z

Reserved: 2024-10-21T12:17:06.019Z

Link: CVE-2024-49871

cve-icon Vulnrichment

Updated: 2024-10-22T13:46:59.415Z

cve-icon NVD

Status : Analyzed

Published: 2024-10-21T18:15:08.500

Modified: 2024-10-24T20:22:19.530

Link: CVE-2024-49871

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-10-21T00:00:00Z

Links: CVE-2024-49871 - Bugzilla