Critical Vulnerability in Linux Kernel: ERR_PTR Dereference in mlx90635 Probe
Summary
DEBIAN-CVE-2024-40933: In the Linux kernel, the following vulnerability has been resolved: iio: temperature: mlx90635: Fix ERR_PTR dereference in mlx90635_probe() When devm_regmap_init_i2c() fails, regmap_ee could be error pointer, instead of... Affects linux versions < 6.9.7-1. Fixed in 6.9.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources, facilitates communication between software and hardware, and ensures system stability. The kernel is crucial for system performance and security, making it a prime target for vulnerabilities. This specific vulnerability affects the mlx90635 temperature sensor driver, which is responsible for interfacing with the mlx90635 sensor, potentially leading to system instability or crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mlx90635 temperature sensor driver. The issue arises during the initialization process in the mlx90635_probe() function, where an error pointer (regmap_ee) may not be properly checked. Instead of verifying if regmap_ee is an error using IS_ERR(), the code erroneously checks regmap, which could lead to dereferencing an invalid pointer. This flaw can result in system crashes or undefined behavior, posing a significant risk to system integrity and reliability.
How To Fix
Minimum fixed version
6.9.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel to the fixed version.
Conclusion
The vulnerability in the Linux kernel related to the mlx90635 temperature sensor driver poses a significant risk due to improper error handling. Users are strongly advised to update to the patched version 6.9.7-1 to ensure system stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves an improper check for error pointers in the mlx90635 temperature sensor driver, which can lead to system crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability can cause system instability, crashes, or undefined behavior, affecting overall system performance.
Yes, a patch is available in version 6.9.7-1 of the Linux package. Users should update to this version or later.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
