Описание
In the Linux kernel, the following vulnerability has been resolved:
power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()
If dev_set_name() fails in pwrseq_device_register(), we jump to the
err_put_pwrseq label before initializing pwrseq->targets.
pwrseq_release() will try to iterate over targets unconditionally and
subsequently dereference an invalid pointer. Move the call to
dev_set_name() after the list head is initialized.
A flaw was found in the Linux kernel's power sequencing subsystem. When device registration encounters a naming failure, the error-handling path attempts to clean up data structures before they are initialized. This issue leads to an invalid pointer dereference, which can cause the kernel to crash and result in a Denial of Service (DoS).
Отчет
A moderate-impact denial of service flaw was found in the Linux kernel power sequencing subsystem shipped in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. In pwrseq_device_register(), a failure of dev_set_name() jumps to the error cleanup path before the pwrseq->targets list head is initialized; pwrseq_release() then unconditionally iterates over targets and dereferences an invalid pointer, causing a kernel crash. Triggering the flaw requires local access and high privileges to reach power sequencing device registration, and it further depends on an uncommon failure of dev_set_name() such as a memory allocation error, so the practical likelihood of exploitation is low and the impact is limited to availability (Red Hat CVSS 3.1: 4.1, AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). The kernel packages in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 contain the vulnerable code and are affected; fixes are currently deferred for these products. The residual risk of deferral is low: the flaw is reachable only through a rare error path that requires privileged local action, and its worst outcome is a kernel crash (denial of service) with no impact on confidentiality or integrity. Red Hat Enterprise Linux 6, 7, 8, and 9 kernels, including their real-time (kernel-rt) variants, and the RHEL CoreOS kernels shipped with OpenShift Container Platform are not affected because the vulnerable code is not present in those kernel versions.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected |
Показывать по
Дополнительная информация
Статус:
4.1 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() If dev_set_name() fails in pwrseq_device_register(), we jump to the err_put_pwrseq label before initializing pwrseq->targets. pwrseq_release() will try to iterate over targets unconditionally and subsequently dereference an invalid pointer. Move the call to dev_set_name() after the list head is initialized.
In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() If dev_set_name() fails in pwrseq_device_register(), we jump to the err_put_pwrseq label before initializing pwrseq->targets. pwrseq_release() will try to iterate over targets unconditionally and subsequently dereference an invalid pointer. Move the call to dev_set_name() after the list head is initialized.
power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()
In the Linux kernel, the following vulnerability has been resolved: p ...
In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() If dev_set_name() fails in pwrseq_device_register(), we jump to the err_put_pwrseq label before initializing pwrseq->targets. pwrseq_release() will try to iterate over targets unconditionally and subsequently dereference an invalid pointer. Move the call to dev_set_name() after the list head is initialized.
4.1 Medium
CVSS3