CVE-2024-56587

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

leds: class: Protect brightness_show() with led_cdev->led_access mutex

There is NULL pointer issue observed if from Process A where hid device

being added which results in adding a led_cdev addition and later a

another call to access of led_cdev attribute from Process B can result

in NULL pointer issue.

Use mutex led_cdev->led_access to protect access to led->cdev and its

attribute inside brightness_show() and max_brightness_show() and also

update the comment for mutex that it should be used to protect the led

class device fields.

Process A Process B

kthread+0x114

worker_thread+0x244

process_scheduled_works+0x248

uhid_device_add_worker+0x24

hid_add_device+0x120

device_add+0x268

bus_probe_device+0x94

device_initial_probe+0x14

__device_attach+0xfc

bus_for_each_drv+0x10c

__device_attach_driver+0x14c

driver_probe_device+0x3c

__driver_probe_device+0xa0

really_probe+0x190

hid_device_probe+0x130

ps_p

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References