Описание
In the Linux kernel, the following vulnerability has been resolved:
regcache: Do not overwrite error code when finalizing cache after error
During regcache initialization, if an error occurs in the
cache_ops->populate callback, and if cache operations include an exit
callback, the error code from populate() is overwritten with the return
value from exit(). This hides the error condition from the caller of
regcache_init(), and can cause NULL pointer dereferences when the regcache
is later accessed.
A flaw was found in the Linux kernel's regcache mechanism. During initialization, an error in a specific callback function (cache_ops->populate) can have its error code overwritten by a subsequent exit routine. This masks the original error, potentially causing the system to attempt operations on uninitialized memory. Such actions can result in NULL pointer dereferences, leading to system instability or a denial of service.
Отчет
A flaw was found in the Linux kernel's regcache (register map cache) mechanism. During regcache initialization, if an error occurs in the cache_ops->populate callback and the cache operations include an exit callback, the error code from populate() is overwritten by the return value of exit(). As a result, regcache_init() can incorrectly report success even though the cache was not populated, and later access to the regcache can result in a NULL pointer dereference, leading to a kernel panic and denial of service. Triggering this flaw requires local access and depends on a specific regmap-based driver and cache configuration in which the populate callback fails; there is no impact on confidentiality or integrity. The vulnerable code, introduced when the ->populate() callback was added to regcache, is present only in Red Hat Enterprise Linux 9.9, Red Hat Enterprise Linux 10.3, and Red Hat In-Vehicle OS 2 streams (kernel and kernel-ivos-qualcomm components). Other Red Hat Enterprise Linux versions and update streams (RHEL 6 through RHEL 10.2, including their z-streams) do not contain the vulnerable code and are therefore not affected. For the affected streams, the fix is deferred to a future update because this is a low-impact issue; the residual risk is a kernel panic (denial of service) if a regmap driver's cache population fails during initialization. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat assesses the impact of this flaw as Low because it is not remotely exploitable, requires specific local conditions during driver initialization, and affects only system availability.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cache_ops->populate callback, and if cache operations include an exit callback, the error code from populate() is overwritten with the return value from exit(). This hides the error condition from the caller of regcache_init(), and can cause NULL pointer dereferences when the regcache is later accessed.
In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cache_ops->populate callback, and if cache operations include an exit callback, the error code from populate() is overwritten with the return value from exit(). This hides the error condition from the caller of regcache_init(), and can cause NULL pointer dereferences when the regcache is later accessed.
In the Linux kernel, the following vulnerability has been resolved: r ...
In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cache_ops->populate callback, and if cache operations include an exit callback, the error code from populate() is overwritten with the return value from exit(). This hides the error condition from the caller of regcache_init(), and can cause NULL pointer dereferences when the regcache is later accessed.
EPSS
5.5 Medium
CVSS3