In the Linux kernel, the following vulnerability has been resolved:
usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle
When passing 'phys' in the devicetree to describe the USB PHY phandle (which is the recommended way according to Documentation/devicetree/bindings/usb/ci-hdrc-usb2.txt) the following NULL pointer dereference is observed on i.MX7 and i.MX8MM:
[ 1.489344] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 [ 1.498170] Mem abort info: [ 1.500966] ESR = 0x96000044 [ 1.504030] EC = 0x25: DABT (current EL), IL = 32 bits [ 1.509356] SET = 0, FnV = 0 [ 1.512416] EA = 0, S1PTW = 0 [ 1.515569] FSC = 0x04: level 0 translation fault [ 1.520458] Data abort info: [ 1.523349] ISV = 0, ISS = 0x00000044 [ 1.527196] CM = 0, WnR = 1 [ 1.530176] [0000000000000098] user address but active_mm is swapper [ 1.536544] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 1.542125] Modules linked in: [ 1.545190] CPU: 3 PID: 7 Comm: kworker/u8:0 Not tainted 5.14.0-dirty #3 [ 1.551901] Hardware name: Kontron i.MX8MM N801X S (DT) [ 1.557133] Workqueue: events_unbound deferred_probe_work_func [ 1.562984] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) [ 1.568998] pc : imx7d_charger_detection+0x3f0/0x510 [ 1.573973] lr : imx7d_charger_detection+0x22c/0x510
This happens because the charger functions check for the phy presence inside the imx_usbmisc_data structure (data->usb_phy), but the chipidea core populates the usb_phy passed via 'phys' inside 'struct ci_hdrc' (ci->usb_phy) instead.
This causes the NULL pointer dereference inside imx7d_charger_detection().
Fix it by also searching for 'phys' in case 'fsl,usbphy' is not found.
Tested on a imx7s-warp board.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-devel-azureUpgrade reiserfs-kmp-azureUpgrade kernel-rt-livepatchUpgrade dlm-kmp-64kbUpgrade kernel-rtUpgrade kernel-macrosUpgrade ocfs2-kmp-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-64kbUpgrade dtb-lgUpgrade kernel-64kbUpgrade dtb-alteraUpgrade kernel-rt-vdsoUpgrade kernel-preemptUpgrade dtb-mediatekUpgrade kernel-kvmsmallUpgrade gfs2-kmp-64kbUpgrade dtb-apmUpgrade kernel-rt-develUpgrade dtb-amlogicUpgrade kernel-default-optionalUpgrade kernel-64kb-livepatch-develUpgrade kernel-kvmsmall-develUpgrade dtb-amazonUpgrade dtb-freescaleUpgrade kernel-source-rtUpgrade kernel-default-base-rebuildUpgrade kernel-symsUpgrade dtb-exynosUpgrade kernel-syms-azureUpgrade kernel-zfcpdumpUpgrade ocfs2-kmp-64kbUpgrade kernel-sourceUpgrade dtb-xilinxUpgrade dtb-caviumUpgrade dtb-rockchipUpgrade kernel-rt-optionalUpgrade kernel-default-vdsoUpgrade kernel-rt_debug-develUpgrade dtb-qcomUpgrade gfs2-kmp-rtUpgrade kernel-source-azureUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-default-extraUpgrade kernel-devel-rtUpgrade gfs2-kmp-azureUpgrade kernel-azure-develUpgrade kernel-develUpgrade kernel-azure-optionalUpgrade kernel-default-livepatchUpgrade cluster-md-kmp-rtUpgrade kernel-obs-qaUpgrade kernel-default-develUpgrade kselftests-kmp-azureUpgrade dtb-renesasUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade dtb-hisiliconUpgrade kernel-rt_debug-vdsoUpgrade kernel-docs-htmlUpgrade kernel-default-livepatch-develUpgrade kernel-debug-vdsoUpgrade kernel-debugUpgrade dtb-marvellUpgrade kernel-obs-buildUpgrade kernel-default-baseUpgrade kernel-docsUpgrade dlm-kmp-azureUpgrade dtb-amdUpgrade reiserfs-kmp-rtUpgrade kernel-azureUpgrade kernel-64kb-optionalUpgrade kernel-64kb-extraUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-preempt-develUpgrade dtb-sprdUpgrade dtb-socionextUpgrade kernel-kvmsmall-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade kernel-syms-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-defaultUpgrade kernel-rt_debugUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-64kb-develUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-vdsoUpgrade kernel-source-vanillaUpgrade kernel-azure-extraUpgrade dtb-appleUpgrade dlm-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-armUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-debug-develUpgrade dtb-broadcomUpgrade dtb-allwinner | Aug 9, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub