CVE-2024-58081

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

clk: mmp2: call pm_genpd_init() only after genpd.name is set

Setting the genpd's struct device's name with dev_set_name() is

happening within pm_genpd_init(). If it remains NULL, things can blow up

later, such as when crafting the devfs hierarchy for the power domain:

Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read

...

Call trace:

strlen from start_creating+0x90/0x138

start_creating from debugfs_create_dir+0x20/0x178

debugfs_create_dir from genpd_debug_add.part.0+0x4c/0x144

genpd_debug_add.part.0 from genpd_debug_init+0x74/0x90

genpd_debug_init from do_one_initcall+0x5c/0x244

do_one_initcall from kernel_init_freeable+0x19c/0x1f4

kernel_init_freeable from kernel_init+0x1c/0x12c

kernel_init from ret_from_fork+0x14/0x28

Bisecting tracks this crash back to commit 899f44531fe6 ("pmdomain: core:

Add GENPD_FLAG_DEV_NAME_FW flag"), which exchanges use of

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References