In the Linux kernel, the following vulnerability has been resolved:
net: ti: icss-iep: Fix possible NULL pointer dereference for perout request
The ICSS IEP driver tracks perout and pps enable state with flags. Currently when disabling pps and perout signals during icss_iep_exit(), results in NULL pointer dereference for perout.
To fix the null pointer dereference issue, the icss_iep_perout_enable_hw function can be modified to directly clear the IEP CMP registers when disabling PPS or PEROUT, without referencing the ptp_perout_request structure, as its contents are irrelevant in this case.
| Software | From | Fixed in |
|---|---|---|
| linux / linux_kernel | 6.6.70 | 6.6.88 |
| linux / linux_kernel | 6.12.9 | 6.12.25 |
| linux / linux_kernel | 6.13.1 | 6.14.4 |
| linux / linux_kernel | 6.13 | 6.13.x |
| linux / linux_kernel | 6.13-rc6 | 6.13-rc6.x |
| linux / linux_kernel | 6.13-rc7 | 6.13-rc7.x |
| linux / linux_kernel | 6.15-rc1 | 6.15-rc1.x |
| linux / linux_kernel | 6.15-rc2 | 6.15-rc2.x |