摘要:

In the Linux kernel, the following vulnerability has been resolved:usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init()In cdnsp_endpoint_init(), cdnsp_ring_alloc() is assigned to pep->ringand there is a dereference of it in cdnsp_endpoint_init(), which couldlead to a NULL pointer dereference on failure of cdnsp_ring_alloc().Fix this bug by adding a check of pep->ring.This bug was found by a static analyzer. The analysis employsdifferential checking to identify inconsistent security operations(e.g., checks or kfrees) between two code paths and confirms that theinconsistent operations are not recovered in the current function orthe callers, so they constitute bugs.Note that, as a bug found by static analysis, it can be a falsepositive or hard to trigger. Multiple researchers have cross-reviewedthe bug.Builds with CONFIG_USB_CDNSP_GADGET=y show no new warnings,and our static analyzer no longer warns about this code.

安全等级: Low

公告ID: KylinSec-SA-2024-2558

发布日期: 2024年6月3日

关联CVE: CVE-2021-47528