Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-49985— i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于i2c驱动stm32f7在运行时挂起/恢复期间错误地准备/取消了时钟。

AI Predicted 5.5 Difficulty: Theoretical EPSS 0.20% · P9

Possible ATT&CK Techniques 1 AI

T1055 · Process Injection

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 4e7bca6fc07bf9526d797b9787dcb21e40cd10cf< d6f1250a4d5773f447740b9fe37b8692105796d4 affected
4e7bca6fc07bf9526d797b9787dcb21e40cd10cf< 9b8bc33ad64192f54142396470cc34ce539a8940 affected
4e7bca6fc07bf9526d797b9787dcb21e40cd10cf< 1883cad2cc629ded4a3556c0bbb8b42533ad8764 affected
4e7bca6fc07bf9526d797b9787dcb21e40cd10cf< c2024b1a583ab9176c797ea1e5f57baf8d5e2682 affected
4e7bca6fc07bf9526d797b9787dcb21e40cd10cf< 22a1f8a5b56ba93d3e8b7a1dafa24e01c8bb48ba affected
4e7bca6fc07bf9526d797b9787dcb21e40cd10cf< fac3c9f7784e8184c0338e9f0877b81e55d3ef1c affected
4e7bca6fc07bf9526d797b9787dcb21e40cd10cf< 894cd5f5fd9061983445bbd1fa3d81be43095344 affected
4e7bca6fc07bf9526d797b9787dcb21e40cd10cf< 048bbbdbf85e5e00258dfb12f5e368f908801d7b affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-49985

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume In case there is any sort of clock controller attached to this I2C bus controller, for example Versaclock or even an AIC32x4 I2C codec, then an I2C transfer triggered from the clock controller clk_ops .prepare callback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex. This is because the clock controller first grabs the prepare_lock mutex and then performs the prepare operation, including its I2C access. The I2C access resumes this I2C bus controller via .runtime_resume callback, which calls clk_prepare_enable(), which attempts to grab the prepare_lock mutex again and deadlocks. Since the clock are already prepared since probe() and unprepared in remove(), use simple clk_enable()/clk_disable() calls to enable and disable the clock on runtime suspend and resume, to avoid hitting the prepare_lock mutex.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于i2c驱动stm32f7在运行时挂起/恢复期间错误地准备/取消了时钟。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 4e7bca6fc07bf9526d797b9787dcb21e40cd10cf ~ d6f1250a4d5773f447740b9fe37b8692105796d4 -
Linux Linux 5.0 -

II. Public POCs for CVE-2024-49985

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-49985

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-49985 (5)

Same Patch Batch · Linux · 2024-10-21 · 372 CVEs total

CVE-2024-50033 9.8 CRITICAL slip: make slhc_remember() more robust against malicious packets
CVE-2024-49855 9.8 CRITICAL nbd: fix race between timeout and normal completion
CVE-2024-47695 9.8 CRITICAL RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
CVE-2022-48985 9.8 CRITICAL net: mana: Fix race on per-CQ variable napi work_done
CVE-2022-49003 9.8 CRITICAL nvme: fix SRCU protection of nvme_ns_head list
CVE-2024-50043 9.8 CRITICAL nfsd: fix possible badness in FREE_STATEID
CVE-2024-50047 9.8 CRITICAL smb: client: fix UAF in async decryption
CVE-2024-50046 9.8 CRITICAL NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
CVE-2024-49996 9.4 CRITICAL cifs: Fix buffer overflow when parsing NFS reparse points
CVE-2024-47678 9.4 CRITICAL icmp: change the order of rate limits
CVE-2022-48962 8.8 HIGH net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
CVE-2024-49950 8.8 HIGH Bluetooth: L2CAP: Fix uaf in l2cap_connect
CVE-2024-49939 8.8 HIGH wifi: rtw89: avoid to add interface to list twice when SER
CVE-2022-48967 8.8 HIGH NFC: nci: Bounds check struct nfc_target arrays
CVE-2022-48964 8.8 HIGH ravb: Fix potential use-after-free in ravb_rx_gbeth()
CVE-2024-50029 8.8 HIGH Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync
CVE-2024-49930 8.8 HIGH wifi: ath11k: fix array out-of-bound access in SoC stats
CVE-2024-50041 8.8 HIGH i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
CVE-2024-49936 8.8 HIGH net/xen-netback: prevent UAF in xenvif_flush_hash()
CVE-2022-48954 8.8 HIGH s390/qeth: fix use-after-free in hsci

Showing top 20 of 372 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-49985

No comments yet

Leave a comment