CVE-2023-52749
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-52749
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52749.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-52749
- Downstream
- Related
- Published
- 2024-05-21T15:30:38Z
- Modified
- 2025-10-16T13:09:59.395156Z
- Summary
- spi: Fix null dereference on suspend
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
spi: Fix null dereference on suspend
A race condition exists where a synchronous (noqueue) transfer can be active during a system suspend. This can cause a null pointer dereference exception to occur when the system resumes.
Example order of events leading to the exception: 1. spisync() calls _spitransfermessagenoqueue() which sets ctlr->curmsg 2. Spi transfer begins via spitransferonemessage() 3. System is suspended interrupting the transfer context 4. System is resumed 6. spicontrollerresume() calls spistartqueue() which resets curmsg to NULL 7. Spi transfer context resumes and spifinalizecurrentmessage() is called which dereferences curmsg (which is now NULL)
Wait for synchronous transfers to complete before suspending by acquiring the bus mutex and setting/checking a suspend flag.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedae7d2346dc89ae89a6e0aabe6037591a11e593c0Fixed4ec4508db97502a12daee88c74782e8d35ced068
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedae7d2346dc89ae89a6e0aabe6037591a11e593c0Fixed96474ea47dc67b0704392d59192b233c8197db0e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedae7d2346dc89ae89a6e0aabe6037591a11e593c0Fixedbef4a48f4ef798c4feddf045d49e53c8a97d5e37