CVE-2024-47666

Source
https://cve.org/CVERecord?id=CVE-2024-47666
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-47666.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-47666
Downstream
Related
Published
2024-10-09T14:13:58.849Z
Modified
2026-05-28T03:53:06.943743177Z
Summary
scsi: pm80xx: Set phy->enable_completion only when we wait for it
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm80xx: Set phy->enable_completion only when we wait for it

pm8001phycontrol() populates the enablecompletion pointer with a stack address, sends a PHYLINKRESET / PHYHARDRESET, waits 300 ms, and returns. The problem arises when a phy control response comes late. After 300 ms the pm8001phycontrol() function returns and the passed enablecompletion stack address is no longer valid. Late phy control response invokes complete() on a dangling enable_completion pointer which leads to a kernel crash.

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47666.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
869ddbdcae3b4fb83b99889abae31544c149b210
Fixed
ddc501f4130f4baa787cb6cfa309af697179f475
Fixed
a5d954802bda1aabcba49633cd94bad91c94113f
Fixed
e23ee0cc5bded07e700553aecc333bb20c768546
Fixed
7b1d779647afaea9185fa2f150b1721e7c1aae89
Fixed
f14d3e1aa613311c744af32d75125e95fc8ffb84
Fixed
e4f949ef1516c0d74745ee54a0f4882c1f6c7aea

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-47666.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.15.0
Fixed
5.10.247
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.197
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.159
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.51
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.10.10

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-47666.json"