iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.23 % · percentile 13 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en In sprd_iommu_cleanup() before calling function sprd_iommu_hw_en() dom->sdev is equal to NULL, which leads to null dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Weaknesses (CWE)
- CWE-476 — NULL Pointer Dereference
References
- https://git.kernel.org/stable/c/8c79ceb4ecf823e6ec10fee6febb0fca3de79922
- https://git.kernel.org/stable/c/dfe90030a0cfa26dca4cb6510de28920e5ad22fb
- https://git.kernel.org/stable/c/b62841e49a2b7938f6fdeaaf93fb57e4eb880bdb
- https://git.kernel.org/stable/c/d5fe884ce28c5005f8582c35333c195a168f841c
- https://git.kernel.org/stable/c/630482ee0653decf9e2482ac6181897eb6cde5b8
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-39500
- GCVE · GCVE-0-2024-42277
CERT-FR advisories
- CERTFR-2025-AVI-0022 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0002 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1080 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1013 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0997 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0840 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0822 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0779 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.113 < 5.15.165cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.81 < 6.1.103cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.3.4 < 6.6.44cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.10.3
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 92c089a931fd3939cd32318cf4f54e69e8f51a19 < 8c79ceb4ecf823e6ec10fee6febb0fca3de79922 ; affected 8745f3592ee4a7b49ede16ddd3f12a41ecaa23c9 < dfe90030a0cfa26dca4cb6510de28920e5ad22fb ; affected 9afea57384d4ae7b2034593eac7fa76c7122762a < b62841e49a2b7938f6fdeaaf93fb57e4eb880bdb ; affected 9afea57384d4ae7b2034593eac7fa76c7122762a < d5fe884ce28c5005f8582c35333c195a168f841c ; affected 9afea57384d4ae7b2034593eac7fa76c7122762a < 630482ee0653decf9e2482ac6181897eb6cde5b8 ; affected d0a917fd5e3b3ed9d9306b4260ba684b982da9f3 |
| Linux · Linux | affected 6.4 ; unaffected 0 < 6.4 ; unaffected 5.15.165 ≤ 5.15.* ; unaffected 6.1.103 ≤ 6.1.* ; unaffected 6.6.44 ≤ 6.6.* ; unaffected 6.10.3 ≤ 6.10.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |