CVE-2024-47666

scsi: pm80xx: Set phy->enable_completion only when we wait for it

published October 9, 2024

CVSS
—
EPSS
0%
Percentile
10.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm80xx: Set phy->enable_completion only when we wait for it

pm8001_phy_control() populates the enable_completion pointer with a stack

address, sends a PHY_LINK_RESET / PHY_HARD_RESET, waits 300 ms, and

returns. The problem arises when a phy control response comes late. After

300 ms the pm8001_phy_control() function returns and the passed

enable_completion stack address is no longer valid. Late phy control

response invokes complete() on a dangling enable_completion pointer which

leads to a kernel crash.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00207 · 10.2th percentile
Published
2024-10-09T14:13Z
EPSS history
Timeline
  • 09 OCT 14:13Z
    scsi: pm80xx: Set phy->enable_completion only when we wait for it
    cvelistv5