CVE-2024-35796

net: ll_temac: platform_get_resource replaced by wrong function

Description

In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: platform_get_resource replaced by wrong function The function platform_get_resource was replaced with devm_platform_ioremap_resource_byname and is called using 0 as name. This eventually ends up in platform_get_resource_byname in the call stack, where it causes a null pointer in strcmp. if (type == resource_type(r) && !strcmp(r->name, name)) It should have been replaced with devm_platform_ioremap_resource.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.06%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/6d9395ba7f85bdb7af0b93272e537484ecbeff48
https://git.kernel.org/stable/c/553d294db94b5f139378022df480a9fb6c3ae39e
https://git.kernel.org/stable/c/46efbdbc95a30951c2579caf97b6df2ee2b3bef3
https://git.kernel.org/stable/c/476eed5f1c22034774902a980aa48dc4662cb39a
https://git.kernel.org/stable/c/7e9edb569fd9f688d887e36db8170f6e22bafbc8
https://git.kernel.org/stable/c/92c0c29f667870f17c0b764544bdf22ce0e886a1
https://git.kernel.org/stable/c/3a38a829c8bc27d78552c28e582eb1d885d07d11
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html

Frequently Asked Questions

What is the severity of CVE-2024-35796?: CVE-2024-35796 has been scored as a medium severity vulnerability.
How to fix CVE-2024-35796?: To fix CVE-2024-35796, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-35796 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-35796 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-35796?: CVE-2024-35796 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.