Null Pointer Dereference Vulnerability in Linux Kernel - CVE-2024-38543
Summary
CVE-2024-38543: In the Linux kernel, the following vulnerability has been resolved: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure The kcalloc() in dmirror_device_evict_chunk() will return null if the physical memory ha... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software management. It is known for its stability, performance, and scalability. However, like any complex software, it is susceptible to vulnerabilities that can affect its functionality and security. CVE-2024-38543 specifically impacts the memory allocation process within the kernel, which is critical for managing system resources efficiently.
Vulnerability Detail
CVE-2024-38543 is a null pointer dereference vulnerability that arises from the failure of memory allocation in the dmirror_device_evict_chunk() function. When the kcalloc() function is called to allocate memory for src_pfns and dst_pfns, it may return null if the physical memory is exhausted. If this null pointer is subsequently dereferenced, it leads to a crash or undefined behavior in the kernel. This vulnerability is particularly concerning as it can prevent the eviction of pages mapping a chunk when the device is being removed, potentially leading to system instability or crashes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid the null pointer dereference by ensuring that the memory allocation does not fail. This can be achieved by modifying the kernel code to include the __GFP_NOFAIL flag in the kcalloc() function call, ensuring that the allocation does not return null. However, this requires access to the kernel source code and recompilation, which may not be feasible for all users.
Conclusion
CVE-2024-38543 is a critical vulnerability in the Linux kernel that can lead to severe system instability due to null pointer dereference. It is essential for users to update their systems to the latest kernel versions to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2024-38543 is a vulnerability in the Linux kernel that can lead to a null pointer dereference due to memory allocation failures.
This vulnerability can cause system crashes or instability when the kernel attempts to dereference a null pointer during memory management operations.
The vulnerability affects various versions of the Linux kernel in Debian 11, 12, and 13, particularly before the specified fixed versions.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If an immediate update is not possible, consider implementing the suggested workaround to mitigate the risk until an update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
