NULL Pointer Dereference in Linux Kernel's PCI Keystone Subsystem
Summary
CVE-2024-43823: In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() If IORESOURCE_MEM is not provided in Device Tree due to a... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The PCI (Peripheral Component Interconnect) subsystem is crucial for managing hardware devices connected to the system. This vulnerability affects the Keystone PCI subsystem, which is designed for specific hardware configurations. The issue arises when the Device Tree does not provide the necessary IORESOURCE_MEM, leading to potential system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the PCI Keystone subsystem, specifically in the ks_pcie_setup_rc_app_regs() function. If the IORESOURCE_MEM is missing from the Device Tree due to an error, the resource_list_first_type() function returns NULL. Consequently, the pci_parse_request_of_pci_ranges() function emits a warning but does not handle the NULL return properly, resulting in a NULL pointer dereference. This can lead to system crashes and instability, making it a critical issue for systems relying on this functionality. The vulnerability was discovered by the Linux Verification Center.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the kernel updates as soon as they are available.
Conclusion
The CVE-2024-43823 vulnerability in the Linux kernel's PCI Keystone subsystem poses a significant risk of system crashes due to NULL pointer dereference. Users are strongly advised to update their kernel to the latest version to mitigate this issue. Regular monitoring with tools like Vulert can help ensure that your systems remain secure against such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
CVE-2024-43823 is a vulnerability in the Linux kernel's PCI Keystone subsystem that can lead to a NULL pointer dereference, causing system crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability can lead to system instability and crashes, particularly affecting systems that rely on the PCI Keystone subsystem.
Yes, patches are available in the latest kernel updates for Debian systems. Ensure your kernel version is updated to at least 6.1.106-1 for Debian 12 or 6.10.3-1 for Debian 13.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
