In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: Check for port partner validity before consuming it
typecregisterpartner() does not guarantee partner registration to always succeed. In the event of failure, port->partner is set to the error value or NULL. Given that port->partner validity is not checked, this results in the following crash:
Unable to handle kernel NULL pointer dereference at virtual address xx pc : runstatemachine+0x1bc8/0x1c08 lr : runstatemachine+0x1b90/0x1c08 .. Call trace: runstatemachine+0x1bc8/0x1c08 tcpmstatemachinework+0x94/0xe4 kthreadworkerfn+0x118/0x328 kthread+0x1d0/0x23c retfrom_fork+0x10/0x20
To prevent the crash, check for port->partner validity before derefencing it in all the call sites.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc2b655cb6dd2b381f1f284989721002e39b6b77",
"target": {
"function": "tcpm_register_partner_altmodes",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-0aeb1467",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "163645654009076000984907468095714459460",
"length": 412.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae11f04b452b5205536e1c02d31f8045eba249dd",
"target": {
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-24a002ea",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123158590127360800503050565044825786892",
"43152030253027977016247082409701815306",
"312651333936369057079142717578145808432",
"253870367037935576190777599910307212191",
"267166945443114119404659184730948004521",
"310753608976047776461583232754795915490",
"239159107616230277323067484988931977838",
"93987164966460574656018317203867823526",
"136136302989393979429676366892245910580",
"98640054935749866112177218080152136242",
"200774039038646929217061921349438734572",
"108299966537688344353148980097529278967",
"110426302902100741001284206700986041063",
"328229457400536915447452562356092021742",
"119307779727548973832817551131949524838",
"270875386928917285545555343775863967519",
"249655514428661403366193003628783627282",
"87064195280962556207119018443274061860",
"8707313341322483138412531373086148329",
"161072914497460805917602482145565374411",
"322366030781367401611034186161986594955",
"326500690336431677927481258878621232549",
"35667062469733416837220115274675754849",
"146791260194124768503332029670140172659",
"251724112262493722542250319141336095450",
"295312049118344857054861941018279150705",
"79800292936669883580104462765387508549",
"43868886343254232985736030741470844347"
]
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc2b655cb6dd2b381f1f284989721002e39b6b77",
"target": {
"function": "tcpm_typec_connect",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-278fd0ec",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "196193805290410538016024227887835198875",
"length": 613.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc2b655cb6dd2b381f1f284989721002e39b6b77",
"target": {
"function": "tcpm_typec_disconnect",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-2caa1894",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "210214868626452679852492247478893826291",
"length": 199.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d56d2ca03cc22123fd7626967d096d8661324e57",
"target": {
"function": "tcpm_typec_disconnect",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-324de883",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "210214868626452679852492247478893826291",
"length": 199.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d56d2ca03cc22123fd7626967d096d8661324e57",
"target": {
"function": "tcpm_set_initial_svdm_version",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-35536733",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "114380423974978709011511527196166121645",
"length": 242.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789326cafbd1f67f424436b6bc8bdb887a364637",
"target": {
"function": "tcpm_register_partner_altmodes",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-396c243d",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "163645654009076000984907468095714459460",
"length": 412.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a07e6f0ad8a6e504a3912cfe8dc859b7d0740a5",
"target": {
"function": "tcpm_typec_connect",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-4ce3fdd4",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "230262379255278598882204997083341466399",
"length": 559.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789326cafbd1f67f424436b6bc8bdb887a364637",
"target": {
"function": "tcpm_typec_disconnect",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-4fd8d0c6",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "210214868626452679852492247478893826291",
"length": 199.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae11f04b452b5205536e1c02d31f8045eba249dd",
"target": {
"function": "tcpm_register_partner_altmodes",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-5d52e5d0",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "163645654009076000984907468095714459460",
"length": 412.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d56d2ca03cc22123fd7626967d096d8661324e57",
"target": {
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-65fc8c1c",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123158590127360800503050565044825786892",
"43152030253027977016247082409701815306",
"312651333936369057079142717578145808432",
"253870367037935576190777599910307212191",
"267166945443114119404659184730948004521",
"310753608976047776461583232754795915490",
"239159107616230277323067484988931977838",
"93987164966460574656018317203867823526",
"136136302989393979429676366892245910580",
"98640054935749866112177218080152136242",
"200774039038646929217061921349438734572",
"108299966537688344353148980097529278967",
"110426302902100741001284206700986041063",
"328229457400536915447452562356092021742",
"119307779727548973832817551131949524838",
"270875386928917285545555343775863967519",
"249655514428661403366193003628783627282",
"87064195280962556207119018443274061860",
"140882719708544141097168330551816490074",
"272803334612336175051329042682559409332",
"322366030781367401611034186161986594955",
"326500690336431677927481258878621232549",
"35667062469733416837220115274675754849",
"146791260194124768503332029670140172659",
"251724112262493722542250319141336095450",
"295312049118344857054861941018279150705",
"79800292936669883580104462765387508549",
"43868886343254232985736030741470844347"
]
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae11f04b452b5205536e1c02d31f8045eba249dd",
"target": {
"function": "tcpm_typec_disconnect",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-7aeedcd9",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "250511453142752370258021569192527389203",
"length": 317.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789326cafbd1f67f424436b6bc8bdb887a364637",
"target": {
"function": "svdm_consume_identity",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-8980c081",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "66367815508658054063030655037004088012",
"length": 511.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc2b655cb6dd2b381f1f284989721002e39b6b77",
"target": {
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-8cada016",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123158590127360800503050565044825786892",
"43152030253027977016247082409701815306",
"312651333936369057079142717578145808432",
"253870367037935576190777599910307212191",
"267166945443114119404659184730948004521",
"310753608976047776461583232754795915490",
"239159107616230277323067484988931977838",
"93987164966460574656018317203867823526",
"136136302989393979429676366892245910580",
"98640054935749866112177218080152136242",
"200774039038646929217061921349438734572",
"108299966537688344353148980097529278967",
"110426302902100741001284206700986041063",
"328229457400536915447452562356092021742",
"119307779727548973832817551131949524838",
"270875386928917285545555343775863967519",
"249655514428661403366193003628783627282",
"87064195280962556207119018443274061860",
"140882719708544141097168330551816490074",
"272803334612336175051329042682559409332",
"322366030781367401611034186161986594955",
"326500690336431677927481258878621232549",
"35667062469733416837220115274675754849",
"146791260194124768503332029670140172659",
"251724112262493722542250319141336095450",
"295312049118344857054861941018279150705",
"79800292936669883580104462765387508549",
"43868886343254232985736030741470844347"
]
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789326cafbd1f67f424436b6bc8bdb887a364637",
"target": {
"function": "tcpm_typec_connect",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-9703ae49",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "196193805290410538016024227887835198875",
"length": 613.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a07e6f0ad8a6e504a3912cfe8dc859b7d0740a5",
"target": {
"function": "tcpm_set_initial_svdm_version",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-9eff71a1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "114380423974978709011511527196166121645",
"length": 242.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a07e6f0ad8a6e504a3912cfe8dc859b7d0740a5",
"target": {
"function": "svdm_consume_identity",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-b08dc5e9",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "66367815508658054063030655037004088012",
"length": 511.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789326cafbd1f67f424436b6bc8bdb887a364637",
"target": {
"function": "tcpm_set_initial_svdm_version",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-b73d660f",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "114380423974978709011511527196166121645",
"length": 242.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d56d2ca03cc22123fd7626967d096d8661324e57",
"target": {
"function": "tcpm_register_partner_altmodes",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-b8d1d408",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "163645654009076000984907468095714459460",
"length": 412.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc2b655cb6dd2b381f1f284989721002e39b6b77",
"target": {
"function": "svdm_consume_identity",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-bd50d1ae",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "66367815508658054063030655037004088012",
"length": 511.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a07e6f0ad8a6e504a3912cfe8dc859b7d0740a5",
"target": {
"function": "tcpm_register_partner_altmodes",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-c6bac5a9",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "163645654009076000984907468095714459460",
"length": 412.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d56d2ca03cc22123fd7626967d096d8661324e57",
"target": {
"function": "svdm_consume_identity",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-c8d2231a",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "66367815508658054063030655037004088012",
"length": 511.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae11f04b452b5205536e1c02d31f8045eba249dd",
"target": {
"function": "tcpm_set_initial_svdm_version",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-ca204ec9",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "114380423974978709011511527196166121645",
"length": 242.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc2b655cb6dd2b381f1f284989721002e39b6b77",
"target": {
"function": "tcpm_set_initial_svdm_version",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-cd8c39fa",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "114380423974978709011511527196166121645",
"length": 242.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789326cafbd1f67f424436b6bc8bdb887a364637",
"target": {
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-cdb591ba",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123158590127360800503050565044825786892",
"43152030253027977016247082409701815306",
"312651333936369057079142717578145808432",
"253870367037935576190777599910307212191",
"267166945443114119404659184730948004521",
"310753608976047776461583232754795915490",
"239159107616230277323067484988931977838",
"93987164966460574656018317203867823526",
"136136302989393979429676366892245910580",
"98640054935749866112177218080152136242",
"200774039038646929217061921349438734572",
"108299966537688344353148980097529278967",
"110426302902100741001284206700986041063",
"328229457400536915447452562356092021742",
"119307779727548973832817551131949524838",
"270875386928917285545555343775863967519",
"249655514428661403366193003628783627282",
"87064195280962556207119018443274061860",
"140882719708544141097168330551816490074",
"272803334612336175051329042682559409332",
"322366030781367401611034186161986594955",
"326500690336431677927481258878621232549",
"35667062469733416837220115274675754849",
"146791260194124768503332029670140172659",
"251724112262493722542250319141336095450",
"295312049118344857054861941018279150705",
"79800292936669883580104462765387508549",
"43868886343254232985736030741470844347"
]
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a07e6f0ad8a6e504a3912cfe8dc859b7d0740a5",
"target": {
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-edfaf868",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123158590127360800503050565044825786892",
"43152030253027977016247082409701815306",
"312651333936369057079142717578145808432",
"253870367037935576190777599910307212191",
"267166945443114119404659184730948004521",
"310753608976047776461583232754795915490",
"239159107616230277323067484988931977838",
"93987164966460574656018317203867823526",
"136136302989393979429676366892245910580",
"98640054935749866112177218080152136242",
"200774039038646929217061921349438734572",
"108299966537688344353148980097529278967",
"110426302902100741001284206700986041063",
"328229457400536915447452562356092021742",
"119307779727548973832817551131949524838",
"272795682685979244814276978306679126979",
"335229018764228086743902470878455367800",
"207262061086494620036027013344637703084",
"153336322330195659387208157231986127317",
"28580836982061073736856053318852054883",
"56291766767509067701586422576015477499",
"35667062469733416837220115274675754849",
"146791260194124768503332029670140172659",
"251724112262493722542250319141336095450",
"295312049118344857054861941018279150705",
"79800292936669883580104462765387508549",
"43868886343254232985736030741470844347"
]
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d56d2ca03cc22123fd7626967d096d8661324e57",
"target": {
"function": "tcpm_typec_connect",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-f874e9be",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "196193805290410538016024227887835198875",
"length": 613.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae11f04b452b5205536e1c02d31f8045eba249dd",
"target": {
"function": "tcpm_typec_connect",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-fc01f374",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "196193805290410538016024227887835198875",
"length": 613.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a07e6f0ad8a6e504a3912cfe8dc859b7d0740a5",
"target": {
"function": "tcpm_typec_disconnect",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-ff4476a9",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "245529449557251061946544662304764391780",
"length": 160.0
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae11f04b452b5205536e1c02d31f8045eba249dd",
"target": {
"function": "svdm_consume_identity",
"file": "drivers/usb/typec/tcpm/tcpm.c"
},
"id": "CVE-2024-36893-ff47f5eb",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "66367815508658054063030655037004088012",
"length": 511.0
},
"deprecated": false
}
]