In the Linux kernel, the following vulnerability has been resolved:
usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle
When passing 'phys' in the devicetree to describe the USB PHY phandle (which is the recommended way according to Documentation/devicetree/bindings/usb/ci-hdrc-usb2.txt) the following NULL pointer dereference is observed on i.MX7 and i.MX8MM:
[ 1.489344] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 [ 1.498170] Mem abort info: [ 1.500966] ESR = 0x96000044 [ 1.504030] EC = 0x25: DABT (current EL), IL = 32 bits [ 1.509356] SET = 0, FnV = 0 [ 1.512416] EA = 0, S1PTW = 0 [ 1.515569] FSC = 0x04: level 0 translation fault [ 1.520458] Data abort info: [ 1.523349] ISV = 0, ISS = 0x00000044 [ 1.527196] CM = 0, WnR = 1 [ 1.530176] [0000000000000098] user address but active_mm is swapper [ 1.536544] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 1.542125] Modules linked in: [ 1.545190] CPU: 3 PID: 7 Comm: kworker/u8:0 Not tainted 5.14.0-dirty #3 [ 1.551901] Hardware name: Kontron i.MX8MM N801X S (DT) [ 1.557133] Workqueue: events_unbound deferred_probe_work_func [ 1.562984] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) [ 1.568998] pc : imx7d_charger_detection+0x3f0/0x510 [ 1.573973] lr : imx7d_charger_detection+0x22c/0x510
This happens because the charger functions check for the phy presence inside the imx_usbmisc_data structure (data->usb_phy), but the chipidea core populates the usb_phy passed via 'phys' inside 'struct ci_hdrc' (ci->usb_phy) instead.
This causes the NULL pointer dereference inside imx7d_charger_detection().
Fix it by also searching for 'phys' in case 'fsl,usbphy' is not found.
Tested on a imx7s-warp board.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-rt-extraUpgrade kselftests-kmp-rtUpgrade kernel-docsUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade dtb-hisiliconUpgrade dtb-armUpgrade kernel-default-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-debug-vdsoUpgrade kernel-preempt-develUpgrade kernel-debugUpgrade kernel-defaultUpgrade kernel-kvmsmall-vdsoUpgrade dtb-sprdUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-nvidiaUpgrade dtb-socionextUpgrade kernel-rt-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-rt_debugUpgrade reiserfs-kmp-64kbUpgrade dtb-allwinnerUpgrade dtb-broadcomUpgrade dlm-kmp-rtUpgrade kernel-debug-develUpgrade kernel-azure-vdsoUpgrade dtb-marvellUpgrade kselftests-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade dtb-renesasUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-syms-rtUpgrade kernel-azure-extraUpgrade dlm-kmp-azureUpgrade kernel-azureUpgrade kernel-64kb-extraUpgrade dtb-appleUpgrade reiserfs-kmp-rtUpgrade dtb-amdUpgrade kernel-64kb-develUpgrade dlm-kmp-defaultUpgrade kernel-sourceUpgrade kernel-azure-livepatch-develUpgrade kernel-default-optionalUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-debug-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-livepatchUpgrade kernel-default-extraUpgrade kernel-rt_debug-develUpgrade kernel-obs-qaUpgrade gfs2-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-preemptUpgrade kernel-syms-azureUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-zfcpdumpUpgrade dtb-alteraUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmallUpgrade kernel-azure-optionalUpgrade kernel-default-develUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-64kbUpgrade dtb-lgUpgrade dtb-qcomUpgrade kernel-macrosUpgrade kernel-develUpgrade kernel-azure-develUpgrade kernel-symsUpgrade kernel-devel-azureUpgrade dtb-caviumUpgrade cluster-md-kmp-azureUpgrade dtb-rockchipUpgrade kernel-rt-optionalUpgrade kselftests-kmp-64kbUpgrade dtb-amazonUpgrade reiserfs-kmp-azureUpgrade dtb-mediatekUpgrade dtb-xilinxUpgrade kernel-default-base-rebuildUpgrade kernel-default-livepatchUpgrade kernel-rtUpgrade kernel-source-rtUpgrade kernel-source-azureUpgrade kernel-rt-develUpgrade ocfs2-kmp-rtUpgrade dtb-exynosUpgrade dtb-amlogicUpgrade dtb-freescaleUpgrade dtb-apmUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmall-devel | Aug 9, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub