Описание
In the Linux kernel, the following vulnerability has been resolved:
power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
If memory allocation fails in pwrseq_unit_setup_deps(), pwrseq_unit_put()
is called to release the partially initialized unit. However, we've
never initialized unit->list and pwrseq_unit_release() will
unconditionally call list_del() on it. Initialize unit->list right after
allocating the unit struct.
A flaw was found in the Linux kernel's power sequencing subsystem. If a memory allocation failure occurs while setting up dependencies in pwrseq_unit_setup_deps(), error handling cleans up the partially allocated unit without having initialized its internal list. This uninitialized state leads to a NULL pointer dereference during cleanup, causing a kernel crash and resulting in a Denial of Service (DoS).
Отчет
A flaw of moderate impact was found in the Linux kernel power sequencing subsystem (drivers/power/sequencing/core.c) as shipped in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. If a memory allocation fails while setting up unit dependencies in pwrseq_unit_setup_deps(), the error path releases the partially initialized unit, and pwrseq_unit_release() unconditionally calls list_del() on the unit's not-yet-initialized list, causing a NULL pointer dereference that crashes the kernel (denial of service). Exploiting this requires privileged local access to the system and depends on an unexpected memory allocation failure during power sequencing unit setup, which is reflected in the Red Hat CVSS 3.1 score of 4.1 (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H); only availability is impacted. Fixes for the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 kernels are deferred to a future planned update because this is a low-severity, hard-to-trigger error-path defect; the residual risk is that a local privileged user who can induce the allocation failure could crash the system. Earlier Red Hat Enterprise Linux versions (including kernel and kernel-rt in RHEL 6 through 9) and the OpenShift Container Platform RHEL CoreOS images are not affected because the vulnerable code, introduced upstream in the 6.11 kernel, is not present in those products.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
4.1 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() If memory allocation fails in pwrseq_unit_setup_deps(), pwrseq_unit_put() is called to release the partially initialized unit. However, we've never initialized unit->list and pwrseq_unit_release() will unconditionally call list_del() on it. Initialize unit->list right after allocating the unit struct.
In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() If memory allocation fails in pwrseq_unit_setup_deps(), pwrseq_unit_put() is called to release the partially initialized unit. However, we've never initialized unit->list and pwrseq_unit_release() will unconditionally call list_del() on it. Initialize unit->list right after allocating the unit struct.
In the Linux kernel, the following vulnerability has been resolved: p ...
In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() If memory allocation fails in pwrseq_unit_setup_deps(), pwrseq_unit_put() is called to release the partially initialized unit. However, we've never initialized unit->list and pwrseq_unit_release() will unconditionally call list_del() on it. Initialize unit->list right after allocating the unit struct.
EPSS
4.1 Medium
CVSS3