ACPI: video: check for error while searching for backlight device parent (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.25 % · centile 16 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: ACPI: video: check for error while searching for backlight device parent If acpi_get_parent() called in acpi_video_dev_register_backlight() fails, for example, because acpi_ut_acquire_mutex() fails inside acpi_get_parent), this can lead to incorrect (uninitialized) acpi_parent handle being passed to acpi_get_pci_dev() for detecting the parent pci device. Check acpi_get_parent() result and set parent device only in case of success. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Références
- https://git.kernel.org/stable/c/556f02699d33c1f40b1b31bd25828ce08fa165d8
- https://git.kernel.org/stable/c/1e3a2b9b4039bb4d136dca59fb31e06465e056f3
- https://git.kernel.org/stable/c/c4e1a0ef0b4782854c9b77a333ca912b392bed2f
- https://git.kernel.org/stable/c/3a370502a5681986f9828e43be75ce26c6ab24af
- https://git.kernel.org/stable/c/2124c5bc22948fc4d09a23db4a8acdccc7d21e95
- https://git.kernel.org/stable/c/39af144b6d01d9b40f52e5d773e653957e6c379c
- https://git.kernel.org/stable/c/72884ce4e10417b1233b614bf134da852df0f15f
- https://git.kernel.org/stable/c/ccd45faf4973746c4f30ea41eec864e5cf191099
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2023-57317
- GCVE · GCVE-0-2023-52693
Avis du CERT-FR
- CERTFR-2024-AVI-0717 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0693 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0610 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0527 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0526 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0496 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 2.6.39 < 4.19.306cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.268cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.209cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.148cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.75cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.14cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.7.2cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 9661e92c10a9775243c1ecb73373528ed8725a10 < 556f02699d33c1f40b1b31bd25828ce08fa165d8 ; affected 9661e92c10a9775243c1ecb73373528ed8725a10 < 1e3a2b9b4039bb4d136dca59fb31e06465e056f3 ; affected 9661e92c10a9775243c1ecb73373528ed8725a10 < c4e1a0ef0b4782854c9b77a333ca912b392bed2f ; affected 9661e92c10a9775243c1ecb73373528ed8725a10 < 3a370502a5681986f9828e43be75ce26c6ab24af ; affected 9661e92c10a9775243c1ecb73373528ed8725a10 < 2124c5bc22948fc4d09a23db4a8acdccc7d21e95 ; affected 9661e92c10a9775243c1ecb73373528ed8725a10 < 39af144b6d01d9b40f52e5d773e653957e6c379c |
| Linux · Linux | affected 2.6.39 ; unaffected 0 < 2.6.39 ; unaffected 4.19.306 ≤ 4.19.* ; unaffected 5.4.268 ≤ 5.4.* ; unaffected 5.10.209 ≤ 5.10.* ; unaffected 5.15.148 ≤ 5.15.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |