Null Pointer Dereference in Linux Kernel's int3472 Driver - CVE-2024-58011
Summary
CVE-2024-58011: In the Linux kernel, the following vulnerability has been resolved: platform/x86: int3472: Check for adev == NULL Not all devices have an ACPI companion fwnode, so adev might be NULL. Affects linux versions < 6.1.129-1. Fixed in 6.1.129-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of devices and architectures, making it a critical part of system functionality. The int3472 driver is responsible for managing specific hardware components, particularly those related to ACPI (Advanced Configuration and Power Interface). This vulnerability arises from a lack of proper checks for device pointers, potentially leading to system instability.
Vulnerability Detail
CVE-2024-58011 is a vulnerability in the Linux kernel's int3472 driver, where the absence of a check for a NULL device pointer (adev) can lead to a NULL pointer dereference. This situation may occur when a user manually binds the int3472 driver to a different I2C or platform device via sysfs. If the driver attempts to access the NULL pointer, it could result in a system crash or unexpected behavior, compromising system reliability and security.
How To Fix
Minimum fixed version
6.1.129-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid manually binding the int3472 driver to other devices through sysfs until the kernel is updated. This will help prevent the occurrence of the NULL pointer dereference until a proper fix is applied.
Conclusion
CVE-2024-58011 is a significant vulnerability in the Linux kernel's int3472 driver that can lead to system crashes due to a NULL pointer dereference. Users are advised to update their kernel to the latest version to mitigate this risk. Until the update can be applied, avoiding certain driver bindings can serve as a temporary workaround.
See every vulnerability recorded for linux →
FAQ
CVE-2024-58011 is a vulnerability in the Linux kernel's int3472 driver that can lead to a NULL pointer dereference, potentially causing system crashes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The primary risk is system instability, which may lead to crashes or unexpected behavior, affecting the overall reliability of the system.
Yes, a patch has been released for the Linux kernel that addresses this vulnerability. Users should update their kernel to the latest version.
As a temporary measure, avoid manually binding the int3472 driver to other devices through sysfs until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
