CVE-2024-35883: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35883 affects the Linux kernel's SPI subsystem, specifically in the Microchip PCI1xxx driver. The vulnerability was discovered and disclosed on May 19, 2024, and involves a potential null pointer dereference in the pci1xxx_spi_probe function. This issue affects Linux kernel versions from 6.2 through 6.6.26, versions from 6.7 through 6.8.5, and release candidates 6.9-rc1 and 6.9-rc2 (NVD).

The vulnerability stems from inadequate null pointer checking in the pci1xxx_spi_probe function within the SPI driver. Specifically, the issue occurs when memory allocation fails through the devm_kzalloc function, which could lead to a null pointer dereference when accessing spi_bus->spi_int[iter] later in the code. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

If exploited, this vulnerability could lead to a denial of service condition through a kernel crash when the null pointer is dereferenced. The impact is limited to local attacks and requires local user privileges to exploit (NVD).

The vulnerability requires local access and low privileges to exploit. There are no known public exploits at the time of reporting, and the vulnerability can only be triggered through local access to the affected system (NVD).

The issue has been fixed in the Linux kernel through a patch that adds proper null pointer checking. The fix involves adding a check for spi_bus->spi_int[iter] after the devm_kzalloc call and returning -ENOMEM if the allocation fails. The patch has been integrated into various kernel versions and distributions (Kernel Patch).