CVE-2024-56621

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Cancel RTC work during ufshcd_remove()

Currently, RTC work is only cancelled during __ufshcd_wl_suspend(). When

ufshcd is removed in ufshcd_remove(), RTC work is not cancelled. Due to

this, any further trigger of the RTC work after ufshcd_remove() would

result in a NULL pointer dereference as below:

Unable to handle kernel NULL pointer dereference at virtual address 00000000000002a4

Workqueue: events ufshcd_rtc_work

Call trace:

_raw_spin_lock_irqsave+0x34/0x8c

pm_runtime_get_if_active+0x24/0xb4

ufshcd_rtc_work+0x124/0x19c

process_scheduled_works+0x18c/0x2d8

worker_thread+0x144/0x280

kthread+0x11c/0x128

ret_from_fork+0x10/0x20

Since RTC work accesses the ufshcd internal structures, it should be cancelled

when ufshcd is removed. So do that in ufshcd_remove(), as per the order in

ufshcd_init().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References