CVE-2024-46693

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-46693
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-46693.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-46693
Downstream
Related
Published
2024-09-13T05:29:22Z
Modified
2025-10-22T02:14:03.368439Z
Summary
soc: qcom: pmic_glink: Fix race during initialization
Details

In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: pmic_glink: Fix race during initialization

As pointed out by Stephen Boyd it is possible that during initialization of the pmic_glink child drivers, the protection-domain notifiers fires, and the associated work is scheduled, before the client registration returns and as a result the local "client" pointer has been initialized.

The outcome of this is a NULL pointer dereference as the "client" pointer is blindly dereferenced.

Timeline provided by Stephen: CPU0 CPU1 ---- ---- ucsi->client = NULL; devmpmicglinkregisterclient() client->pdrnotify(client->priv, pg->clientstate) pmicglinkucsipdrnotify() schedulework(&ucsi->registerwork) <schedule away> pmicglinkucsiregister() ucsiregister() pmicglinkucsireadversion() pmicglinkucsiread() pmicglinkucsiread() pmicglinksend(ucsi->client) <client is NULL BAD> ucsi->client = client // Too late!

This code is identical across the altmode, battery manager and usci child drivers.

Resolve this by splitting the allocation of the "client" object and the registration thereof into two operations.

This only happens if the protection domain registry is populated at the time of registration, which by the introduction of commit '1ebcde047c54 ("soc: qcom: add pd-mapper implementation")' became much more likely.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
58ef4ece1e41ac525db3e79529909683325d85df
Fixed
1efdbf5323c9360e05066049b97414405e94e087
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
58ef4ece1e41ac525db3e79529909683325d85df
Fixed
943b0e7cc646a624bb20a68080f8f1a4a55df41c
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
58ef4ece1e41ac525db3e79529909683325d85df
Fixed
3568affcddd68743e25aa3ec1647d9b82797757b

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.10.1
v6.10.2
v6.10.3
v6.10.4
v6.10.5
v6.10.6
v6.10.7
v6.11-rc1
v6.2
v6.2-rc2
v6.2-rc3
v6.2-rc4
v6.2-rc5
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.3
v6.3-rc1
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.29
v6.6.3
v6.6.30
v6.6.31
v6.6.32
v6.6.33
v6.6.34
v6.6.35
v6.6.36
v6.6.37
v6.6.38
v6.6.39
v6.6.4
v6.6.40
v6.6.41
v6.6.42
v6.6.43
v6.6.44
v6.6.45
v6.6.46
v6.6.47
v6.6.48
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7

Database specific

vanir_signatures

[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3568affcddd68743e25aa3ec1647d9b82797757b",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "pmic_glink_ucsi_probe",
            "file": "drivers/usb/typec/ucsi/ucsi_glink.c"
        },
        "id": "CVE-2024-46693-0382541a",
        "digest": {
            "length": 1634.0,
            "function_hash": "190750140173912810576411029026688172050"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3568affcddd68743e25aa3ec1647d9b82797757b",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/soc/qcom/pmic_glink.c"
        },
        "id": "CVE-2024-46693-12e1c2a9",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "199319985729714165222492173391263234388",
                "26199792699363879619270144921288923965",
                "228778689657319854413217946523518316442",
                "279139822499007138692074568952676023178",
                "334539343495433417418560802894186218509",
                "317968071486618171218278413777499694798",
                "272415507617875956410886124679884310177",
                "339219491199187822662547971610346485067",
                "153765100704738983334215939879791955054",
                "136614613624386696783028013911361967673",
                "116982987080037697599951200061671725194",
                "209321658855485411111695250097634770912",
                "287979659197814133002810295742922499502",
                "32362394452192644643100936393851317622",
                "120825870383373757038656152370976415787",
                "223796685828684488730538630535050499609",
                "163288740223484229316675727074565813595",
                "32835050109723987166836109316781469290",
                "180863637381812688008147286823554981312",
                "150915744294513786018283352162238189748",
                "306185908372300917885516905802603733800",
                "25466405639657399255908301605307802666",
                "171117499995392633171170482721831616798"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3568affcddd68743e25aa3ec1647d9b82797757b",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/power/supply/qcom_battmgr.c"
        },
        "id": "CVE-2024-46693-2c2fd3e2",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "302116001378848098242828933205054554550",
                "117458531203590002734366526720350422783",
                "303090825916112915218774477073578494958",
                "62687900963252619683236204148149993462",
                "35160066021702911681631403582731643232",
                "146231149989239616749515597231850698312",
                "135350059317698328300841292496814720823",
                "218749822771266921375027320633763669929",
                "75963805686960414943398041017961168053"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1efdbf5323c9360e05066049b97414405e94e087",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "devm_pmic_glink_register_client",
            "file": "drivers/soc/qcom/pmic_glink.c"
        },
        "id": "CVE-2024-46693-2ca78331",
        "digest": {
            "length": 799.0,
            "function_hash": "113623387249953997466532137045251068264"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3568affcddd68743e25aa3ec1647d9b82797757b",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "devm_pmic_glink_register_client",
            "file": "drivers/soc/qcom/pmic_glink.c"
        },
        "id": "CVE-2024-46693-45d13bb8",
        "digest": {
            "length": 799.0,
            "function_hash": "113623387249953997466532137045251068264"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3568affcddd68743e25aa3ec1647d9b82797757b",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "pmic_glink_altmode_probe",
            "file": "drivers/soc/qcom/pmic_glink_altmode.c"
        },
        "id": "CVE-2024-46693-55ad1f31",
        "digest": {
            "length": 2838.0,
            "function_hash": "71875136086539701840564593455124369138"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3568affcddd68743e25aa3ec1647d9b82797757b",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "qcom_battmgr_probe",
            "file": "drivers/power/supply/qcom_battmgr.c"
        },
        "id": "CVE-2024-46693-6a5217b6",
        "digest": {
            "length": 2591.0,
            "function_hash": "23986400281613848327913866859201887536"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3568affcddd68743e25aa3ec1647d9b82797757b",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/usb/typec/ucsi/ucsi_glink.c"
        },
        "id": "CVE-2024-46693-6ff5a8bb",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "130330754435969855054085809749199379552",
                "209366890588037678250962208489418183072",
                "95556437124967949619797063998325433743",
                "247872875094632389430290871061491199245",
                "277442403941984588126677980787909561184",
                "173998858039283415459924290305141438763",
                "308756123780080958544268600881960150365",
                "136568143503642992795576576578068104",
                "98995683791649451622415556104392713804"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1efdbf5323c9360e05066049b97414405e94e087",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/soc/qcom/pmic_glink_altmode.c"
        },
        "id": "CVE-2024-46693-72f4773c",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "128557457268767809516528784941903317395",
                "183666560710125034193743527937744232572",
                "275267339088308894618196352955516448015",
                "5526577256461278386628033024548988984",
                "277036055557848970276774443498340684708",
                "88626107632147836886719856699937106840",
                "110314964982782504465761029054925934095",
                "175813664675500675222840150993964217443",
                "135908646561734275537628607637844420744"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1efdbf5323c9360e05066049b97414405e94e087",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/soc/qcom/pmic_glink.c"
        },
        "id": "CVE-2024-46693-8b462b59",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "199319985729714165222492173391263234388",
                "26199792699363879619270144921288923965",
                "228778689657319854413217946523518316442",
                "279139822499007138692074568952676023178",
                "334539343495433417418560802894186218509",
                "317968071486618171218278413777499694798",
                "272415507617875956410886124679884310177",
                "339219491199187822662547971610346485067",
                "153765100704738983334215939879791955054",
                "136614613624386696783028013911361967673",
                "116982987080037697599951200061671725194",
                "209321658855485411111695250097634770912",
                "287979659197814133002810295742922499502",
                "32362394452192644643100936393851317622",
                "120825870383373757038656152370976415787",
                "223796685828684488730538630535050499609",
                "163288740223484229316675727074565813595",
                "32835050109723987166836109316781469290",
                "180863637381812688008147286823554981312",
                "150915744294513786018283352162238189748",
                "306185908372300917885516905802603733800",
                "25466405639657399255908301605307802666",
                "171117499995392633171170482721831616798"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1efdbf5323c9360e05066049b97414405e94e087",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/power/supply/qcom_battmgr.c"
        },
        "id": "CVE-2024-46693-9907e632",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "302116001378848098242828933205054554550",
                "117458531203590002734366526720350422783",
                "303090825916112915218774477073578494958",
                "62687900963252619683236204148149993462",
                "35160066021702911681631403582731643232",
                "146231149989239616749515597231850698312",
                "135350059317698328300841292496814720823",
                "218749822771266921375027320633763669929",
                "75963805686960414943398041017961168053"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1efdbf5323c9360e05066049b97414405e94e087",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/usb/typec/ucsi/ucsi_glink.c"
        },
        "id": "CVE-2024-46693-993823c6",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "43317922771386079438142970443028680686",
                "308203566517055823862615559641114833188",
                "95556437124967949619797063998325433743",
                "247872875094632389430290871061491199245",
                "277442403941984588126677980787909561184",
                "173998858039283415459924290305141438763",
                "308756123780080958544268600881960150365",
                "136568143503642992795576576578068104",
                "98995683791649451622415556104392713804"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1efdbf5323c9360e05066049b97414405e94e087",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "pmic_glink_ucsi_probe",
            "file": "drivers/usb/typec/ucsi/ucsi_glink.c"
        },
        "id": "CVE-2024-46693-a303c3c1",
        "digest": {
            "length": 1719.0,
            "function_hash": "50679939800606078250898858532852902967"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1efdbf5323c9360e05066049b97414405e94e087",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "include/linux/soc/qcom/pmic_glink.h"
        },
        "id": "CVE-2024-46693-a8dadcb5",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "177437257752367165114948207447183177931",
                "146239018378607831981468695721564847062",
                "283192931078495792134188037056328212220",
                "279139822499007138692074568952676023178",
                "329376957276787268866310262353171875488",
                "218511749077473706684895630749361581238"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3568affcddd68743e25aa3ec1647d9b82797757b",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/soc/qcom/pmic_glink_altmode.c"
        },
        "id": "CVE-2024-46693-c624e7dd",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "128557457268767809516528784941903317395",
                "183666560710125034193743527937744232572",
                "275267339088308894618196352955516448015",
                "5526577256461278386628033024548988984",
                "277036055557848970276774443498340684708",
                "88626107632147836886719856699937106840",
                "110314964982782504465761029054925934095",
                "175813664675500675222840150993964217443",
                "135908646561734275537628607637844420744"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1efdbf5323c9360e05066049b97414405e94e087",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "pmic_glink_altmode_probe",
            "file": "drivers/soc/qcom/pmic_glink_altmode.c"
        },
        "id": "CVE-2024-46693-c748b3b4",
        "digest": {
            "length": 2893.0,
            "function_hash": "23521918836698526985433414382375642508"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1efdbf5323c9360e05066049b97414405e94e087",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "qcom_battmgr_probe",
            "file": "drivers/power/supply/qcom_battmgr.c"
        },
        "id": "CVE-2024-46693-e9abb8d4",
        "digest": {
            "length": 2591.0,
            "function_hash": "23986400281613848327913866859201887536"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3568affcddd68743e25aa3ec1647d9b82797757b",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "include/linux/soc/qcom/pmic_glink.h"
        },
        "id": "CVE-2024-46693-f3fdf941",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "177437257752367165114948207447183177931",
                "146239018378607831981468695721564847062",
                "283192931078495792134188037056328212220",
                "279139822499007138692074568952676023178",
                "329376957276787268866310262353171875488",
                "218511749077473706684895630749361581238"
            ]
        },
        "signature_type": "Line"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.3.0
Fixed
6.6.49
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.10.8