CVE-2024-36930

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

spi: fix null pointer dereference within spi_sync

If spi_sync() is called with the non-empty queue and the same spi_message

is then reused, the complete callback for the message remains set while

the context is cleared, leading to a null pointer dereference when the

callback is invoked from spi_finalize_current_message().

With function inlining disabled, the call stack might look like this:

_raw_spin_lock_irqsave from complete_with_flags+0x18/0x58

complete_with_flags from spi_complete+0x8/0xc

spi_complete from spi_finalize_current_message+0xec/0x184

spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474

spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230

__spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4

__spi_transfer_message_noqueue from __spi_sync+0x204/0x248

__spi_sync from spi_sync+0x24/0x3c

spi_sync from mcp251xfd_regmap_crc_read+0x124

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References