cve-2024-40975
Vulnerability from cvelistv5
Published
2024-07-12 12:32
Modified
2024-12-09 10:43
Severity ?
Summary
platform/x86: x86-android-tablets: Unregister devices in reverse order
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/36ff963c133a25ed1166a25c3ba8b357ea010fda
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f0c982853d665597d17e4995ff479fbbf79a9cf6
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/f0c982853d665597d17e4995ff479fbbf79a9cf6
Impacted products
Vendor Product Version
Linux Linux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:39:56.058Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f0c982853d665597d17e4995ff479fbbf79a9cf6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40975",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:02:40.847310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:22.108Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/x86-android-tablets/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "36ff963c133a",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            },
            {
              "lessThan": "f0c982853d66",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            },
            {
              "lessThan": "3de0f2627ef8",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/x86-android-tablets/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: x86-android-tablets: Unregister devices in reverse order\n\nNot all subsystems support a device getting removed while there are\nstill consumers of the device with a reference to the device.\n\nOne example of this is the regulator subsystem. If a regulator gets\nunregistered while there are still drivers holding a reference\na WARN() at drivers/regulator/core.c:5829 triggers, e.g.:\n\n WARNING: CPU: 1 PID: 1587 at drivers/regulator/core.c:5829 regulator_unregister\n Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 04/10/2015\n RIP: 0010:regulator_unregister\n Call Trace:\n  \u003cTASK\u003e\n  regulator_unregister\n  devres_release_group\n  i2c_device_remove\n  device_release_driver_internal\n  bus_remove_device\n  device_del\n  device_unregister\n  x86_android_tablet_remove\n\nOn the Lenovo Yoga Tablet 2 series the bq24190 charger chip also provides\na 5V boost converter output for powering USB devices connected to the micro\nUSB port, the bq24190-charger driver exports this as a Vbus regulator.\n\nOn the 830 (8\") and 1050 (\"10\") models this regulator is controlled by\na platform_device and x86_android_tablet_remove() removes platform_device-s\nbefore i2c_clients so the consumer gets removed first.\n\nBut on the 1380 (13\") model there is a lc824206xa micro-USB switch\nconnected over I2C and the extcon driver for that controls the regulator.\nThe bq24190 i2c-client *must* be registered first, because that creates\nthe regulator with the lc824206xa listed as its consumer. If the regulator\nhas not been registered yet the lc824206xa driver will end up getting\na dummy regulator.\n\nSince in this case both the regulator provider and consumer are I2C\ndevices, the only way to ensure that the consumer is unregistered first\nis to unregister the I2C devices in reverse order of in which they were\ncreated.\n\nFor consistency and to avoid similar problems in the future change\nx86_android_tablet_remove() to unregister all device types in reverse\norder."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-09T10:43:28.345Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/36ff963c133a25ed1166a25c3ba8b357ea010fda"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0c982853d665597d17e4995ff479fbbf79a9cf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe"
        }
      ],
      "title": "platform/x86: x86-android-tablets: Unregister devices in reverse order",
      "x_generator": {
        "engine": "bippy-8e903de6a542"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40975",
    "datePublished": "2024-07-12T12:32:12.099Z",
    "dateReserved": "2024-07-12T12:17:45.603Z",
    "dateUpdated": "2024-12-09T10:43:28.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40975\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:19.007\",\"lastModified\":\"2024-12-09T13:10:01.607\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nplatform/x86: x86-android-tablets: Unregister devices in reverse order\\n\\nNot all subsystems support a device getting removed while there are\\nstill consumers of the device with a reference to the device.\\n\\nOne example of this is the regulator subsystem. If a regulator gets\\nunregistered while there are still drivers holding a reference\\na WARN() at drivers/regulator/core.c:5829 triggers, e.g.:\\n\\n WARNING: CPU: 1 PID: 1587 at drivers/regulator/core.c:5829 regulator_unregister\\n Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 04/10/2015\\n RIP: 0010:regulator_unregister\\n Call Trace:\\n  \u003cTASK\u003e\\n  regulator_unregister\\n  devres_release_group\\n  i2c_device_remove\\n  device_release_driver_internal\\n  bus_remove_device\\n  device_del\\n  device_unregister\\n  x86_android_tablet_remove\\n\\nOn the Lenovo Yoga Tablet 2 series the bq24190 charger chip also provides\\na 5V boost converter output for powering USB devices connected to the micro\\nUSB port, the bq24190-charger driver exports this as a Vbus regulator.\\n\\nOn the 830 (8\\\") and 1050 (\\\"10\\\") models this regulator is controlled by\\na platform_device and x86_android_tablet_remove() removes platform_device-s\\nbefore i2c_clients so the consumer gets removed first.\\n\\nBut on the 1380 (13\\\") model there is a lc824206xa micro-USB switch\\nconnected over I2C and the extcon driver for that controls the regulator.\\nThe bq24190 i2c-client *must* be registered first, because that creates\\nthe regulator with the lc824206xa listed as its consumer. If the regulator\\nhas not been registered yet the lc824206xa driver will end up getting\\na dummy regulator.\\n\\nSince in this case both the regulator provider and consumer are I2C\\ndevices, the only way to ensure that the consumer is unregistered first\\nis to unregister the I2C devices in reverse order of in which they were\\ncreated.\\n\\nFor consistency and to avoid similar problems in the future change\\nx86_android_tablet_remove() to unregister all device types in reverse\\norder.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: plataforma/x86: x86-android-tablets: cancelar el registro de dispositivos en orden inverso. No todos los subsistemas admiten la eliminaci\u00f3n de un dispositivo mientras todav\u00eda hay consumidores del dispositivo con una referencia al dispositivo. Un ejemplo de esto es el subsistema regulador. Si un regulador se da de baja mientras todav\u00eda hay controladores que tienen una referencia, se activa WARN() en drivers/regulator/core.c:5829, por ejemplo: ADVERTENCIA: CPU: 1 PID: 1587 en drivers/regulator/core.c:5829 regulator_unregister Nombre del hardware: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 10/04/2015 RIP: 0010:regulator_unregister Seguimiento de llamada:  regulator_unregister i2c_device_remove  devres_release_group device_release_driver_internal  device_del device_unregister x86_android_tablet_remove En la serie Lenovo Yoga Tablet 2, el chip del cargador bq24190 tambi\u00e9n proporciona una salida de convertidor elevador de 5 V para alimentar dispositivos USB conectados al puerto micro USB; el controlador del cargador bq24190 lo exporta como un regulador Vbus. En los modelos 830 (8\\\") y 1050 (\\\"10\\\"), este regulador est\u00e1 controlado por un platform_device y x86_android_tablet_remove() elimina platform_device-s antes que i2c_clients para que el consumidor se elimine primero. Pero en el modelo 1380 (13\\\") hay un interruptor micro-USB lc824206xa conectado a trav\u00e9s de I2C y el controlador externo que controla el regulador. El cliente i2c bq24190 *debe* registrarse primero, porque eso crea el regulador con el lc824206xa listado como su consumidor. Si el regulador a\u00fan no se ha registrado, el controlador lc824206xa terminar\u00e1 obteniendo un regulador ficticio. Dado que en este caso tanto el proveedor del regulador como el consumidor son dispositivos I2C, la \u00fanica forma de garantizar que el consumidor cancele el registro primero es cancelar el registro de los dispositivos I2C en el orden inverso al que fueron creados. Para mantener la coherencia y evitar problemas similares en el futuro, cambie x86_android_tablet_remove() para cancelar el registro de todos los tipos de dispositivos en orden inverso.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/36ff963c133a25ed1166a25c3ba8b357ea010fda\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0c982853d665597d17e4995ff479fbbf79a9cf6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/f0c982853d665597d17e4995ff479fbbf79a9cf6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.