CVE-2024-35902

MEDIUM
Published May 19, 2024 Modified May 12, 2026 CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null dereference cp might be null, calling cp->cp_conn would produce null dereference [Simon Horman adds:] Analysis: * cp is a parameter of __rds_rdma_map and is not reassigned. * The following call-sites pass a NULL cp argument to __rds_rdma_map() - rds_get_mr() - rds_get_mr_for_dest * Prior to the code above, the following assumes that cp may be NULL (which is indicative, but could itself be unnecessary) trans_private = rs->rs_transport->get_mr( sg, nents, rs, &mr->r_key, cp ? cp->cp_conn : NULL, args->vec.addr, args->vec.bytes, need_odp ? ODP_ZEROBASED : ODP_NOT_NEEDED); * The code modified by this patch is guarded by IS_ERR(trans_private), where trans_private is assigned as per the previous point in this analysis. The only implementation of get_mr that I could locate is rds_ib_get_mr() which can return an ERR_PTR if the conn (4th) argument is NULL. * ret is set to PTR_ERR(trans_private). rds_ib_get_mr can return ERR_PTR(-ENODEV) if the conn (4th) argument is NULL. Thus ret may be -ENODEV in which case the code in question will execute. Conclusion: * cp may be NULL at the point where this patch adds a check; this patch does seem to address a possible bug

Is your site exposed to CVE-2024-35902?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-476 CWE-476

Affected Products

Vendor Product
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
debian debian_linux

References

Advisories & Patches

https://git.kernel.org/stable/c/62fc3357e079a07a22465b9b6ef71bb6ea75ee4b https://git.kernel.org/stable/c/6794090c742008c53b344b35b021d4a3093dc50a https://git.kernel.org/stable/c/92309bed3c5fbe2ccd4c45056efd42edbd06162d https://git.kernel.org/stable/c/bcd46782e2ec3825d10c1552fcb674d491cc09f9 https://git.kernel.org/stable/c/cbaac2e5488ed54833897264a5ffb2a341a9f196 https://git.kernel.org/stable/c/cfb786b03b03c5ff38882bee38525eb9987e4d14 https://git.kernel.org/stable/c/d275de8ea7be3a453629fddae41d4156762e814c https://git.kernel.org/stable/c/d49fac38479bfdaec52b3ea274d290c47a294029 https://git.kernel.org/stable/c/62fc3357e079a07a22465b9b6ef71bb6ea75ee4b https://git.kernel.org/stable/c/6794090c742008c53b344b35b021d4a3093dc50a https://git.kernel.org/stable/c/92309bed3c5fbe2ccd4c45056efd42edbd06162d https://git.kernel.org/stable/c/bcd46782e2ec3825d10c1552fcb674d491cc09f9 https://git.kernel.org/stable/c/cbaac2e5488ed54833897264a5ffb2a341a9f196 https://git.kernel.org/stable/c/cfb786b03b03c5ff38882bee38525eb9987e4d14 https://git.kernel.org/stable/c/d275de8ea7be3a453629fddae41d4156762e814c https://git.kernel.org/stable/c/d49fac38479bfdaec52b3ea274d290c47a294029

Frequently Asked Questions

What is CVE-2024-35902? +
In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null dereference cp might be null, calling cp->cp_conn would produce null dereference [Simon Horman adds:] Analysis: * cp is a parameter of __rds_rdma_map and is not reassigned. * The following call-sites pass a NULL cp argument to __rds_rdma_map() - rds_get_mr() - rds_get_mr_for_dest * Prior to the code above, the following assumes that cp may be NULL (which is indicative, but could itself be unnecessary) trans_private = rs->rs_transport->get_mr( sg, nents, rs, &mr->r_key, cp ? cp->cp_conn : NULL, args->vec.addr, args->vec.bytes, need_odp ? ODP_ZEROBASED : ODP_NOT_NEEDED); * The code modified by this patch is guarded by IS_ERR(trans_private), where trans_private is assigned as per the previous point in this analysis. The only implementation of get_mr that I could locate is rds_ib_get_mr() which can return an ERR_PTR if the conn (4th) argument is NULL. * ret is set to PTR_ERR(trans_private). rds_ib_get_mr can return ERR_PTR(-ENODEV) if the conn (4th) argument is NULL. Thus ret may be -ENODEV in which case the code in question will execute. Conclusion: * cp may be NULL at the point where this patch adds a check; this patch does seem to address a possible bug It has a CVSS v3.1 base score of 5.5 (MEDIUM).
How severe is CVE-2024-35902? +
CVE-2024-35902 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2024-35902? +
CVE-2024-35902 affects products from debian, linux, specifically: debian_linux, linux_kernel. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-35902? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-8479

IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence …
CVE-2025-24031

PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the …
CVE-2025-31115

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder …
CVE-2025-0121

A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local …
CVE-2023-45925

GNU Midnight Commander 4.8.29-146-g299d9a2fb was discovered to contain a NULL pointer dereference via the function x_error_handler() at tty/x11conn.c. NOTE: this …
CVE-2025-6398

A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. The vulnerability can be triggered …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-35902 — free, no signup required.