CVE-2024-49941

gpiolib: Fix potential NULL pointer dereference in gpiod_get_label()

published October 21, 2024

CVSS
—
EPSS
0%
Percentile
9.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: Fix potential NULL pointer dereference in gpiod_get_label()

In `gpiod_get_label()`, it is possible that `srcu_dereference_check()` may

return a NULL pointer, leading to a scenario where `label->str` is accessed

without verifying if `label` itself is NULL.

This patch adds a proper NULL check for `label` before accessing

`label->str`. The check for `label->str != NULL` is removed because

`label->str` can never be NULL if `label` is not NULL.

This fixes the issue where the label name was being printed as `(efault)`

when dumping the sysfs GPIO file when `label == NULL`.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00202 · 9.5th percentile
Published
2024-10-21T18:02Z
EPSS history
Timeline
  • 21 OCT 18:02Z
    gpiolib: Fix potential NULL pointer dereference in gpiod_get_label()
    cvelistv5