mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 17:21:36 +00:00
37 lines
3.8 KiB
JSON
37 lines
3.8 KiB
JSON
{
|
|
"id": "CVE-2024-42319",
|
|
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"published": "2024-08-17T09:15:11.767",
|
|
"lastModified": "2024-12-14T21:15:21.720",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable()\n\nWhen mtk-cmdq unbinds, a WARN_ON message with condition\npm_runtime_get_sync() < 0 occurs.\n\nAccording to the call tracei below:\n cmdq_mbox_shutdown\n mbox_free_channel\n mbox_controller_unregister\n __devm_mbox_controller_unregister\n ...\n\nThe root cause can be deduced to be calling pm_runtime_get_sync() after\ncalling pm_runtime_disable() as observed below:\n1. CMDQ driver uses devm_mbox_controller_register() in cmdq_probe()\n to bind the cmdq device to the mbox_controller, so\n devm_mbox_controller_unregister() will automatically unregister\n the device bound to the mailbox controller when the device-managed\n resource is removed. That means devm_mbox_controller_unregister()\n and cmdq_mbox_shoutdown() will be called after cmdq_remove().\n2. CMDQ driver also uses devm_pm_runtime_enable() in cmdq_probe() after\n devm_mbox_controller_register(), so that devm_pm_runtime_disable()\n will be called after cmdq_remove(), but before\n devm_mbox_controller_unregister().\n\nTo fix this problem, cmdq_probe() needs to move\ndevm_mbox_controller_register() after devm_pm_runtime_enable() to make\ndevm_pm_runtime_disable() be called after\ndevm_mbox_controller_unregister()."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: buz\u00f3n: mtk-cmdq: mover devm_mbox_controller_register() despu\u00e9s de devm_pm_runtime_enable() Cuando mtk-cmdq se desvincula, aparece un mensaje WARN_ON con la condici\u00f3n pm_runtime_get_sync() < 0. De acuerdo con el seguimiento de llamadas a continuaci\u00f3n: cmdq_mbox_shutdown mbox_free_channel mbox_controller_unregister __devm_mbox_controller_unregister ... Se puede deducir que la causa ra\u00edz es llamar a pm_runtime_get_sync() despu\u00e9s de llamar a pm_runtime_disable() como se observa a continuaci\u00f3n: 1. El controlador CMDQ usa devm_mbox_controller_register() en cmdq_probe() para vincular el cmdq al mbox_controller, por lo que devm_mbox_controller_unregister() cancelar\u00e1 autom\u00e1ticamente el registro del dispositivo vinculado al controlador del buz\u00f3n cuando se elimine el recurso administrado por el dispositivo. Eso significa que devm_mbox_controller_unregister() y cmdq_mbox_shoutdown() ser\u00e1n llamados despu\u00e9s de cmdq_remove(). 2. El controlador CMDQ tambi\u00e9n usa devm_pm_runtime_enable() en cmdq_probe() despu\u00e9s de devm_mbox_controller_register(), por lo que se llamar\u00e1 a devm_pm_runtime_disable() despu\u00e9s de cmdq_remove(), pero antes de devm_mbox_controller_unregister(). Para solucionar este problema, cmdq_probe() necesita mover devm_mbox_controller_register() despu\u00e9s de devm_pm_runtime_enable() para que se llame a devm_pm_runtime_disable() despu\u00e9s de devm_mbox_controller_unregister()."
|
|
}
|
|
],
|
|
"metrics": {},
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/11fa625b45faf0649118b9deaf2d31c86ac41911",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1403991a40b94438a2acc749bf05c117abdb34f9",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a8bd68e4329f9a0ad1b878733e0f80be6a971649",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d00df6700ad10974a7e20646956f4ff22cdbe0ec",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
}
|
|
]
|
|
} |