CVE-2024-58068

In the Linux kernel, the following vulnerability has been resolved:

OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized

If a driver calls dev_pm_opp_find_bw_ceil/floor() the retrieve bandwidth from the OPP table but the bandwidth table was not created because the interconnect properties were missing in the OPP consumer node, the kernel will crash with:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 ... pc : _read_bw+0x8/0x10 lr : _opp_table_find_key+0x9c/0x174 ... Call trace: _read_bw+0x8/0x10 (P) _opp_table_find_key+0x9c/0x174 (L) _find_key+0x98/0x168 dev_pm_opp_find_bw_ceil+0x50/0x88 ...

In order to fix the crash, create an assert function to check if the bandwidth table was created before trying to get a bandwidth with _read_bw().

This vulnerability is rated with a Moderate impact because it requires local access, affects only systems utilizing the Operating Performance Points (OPP) power framework, and is confined to a denial of service. Bandwidth scaling queries under OPP are predominantly utilized on embedded and System-on-Chip (SoC) platforms rather than standard enterprise server deployments. Under vulnerable configurations, missing interconnect attributes can induce a kernel panic via a null pointer dereference without endangering system confidentiality or data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.