Kernel Crash Vulnerability in Linux Package: OPP Bandwidth Table Initialization Issue
Summary
CVE-2024-58068: In the Linux kernel, the following vulnerability has been resolved: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized If a driver calls dev_pm_opp_find_bw_ceil/floor() the retrieve bandwidth from the O... Affects linux versions < 6.1.129-1. Fixed in 6.1.129-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically affects the OPP (Operating Performance Points) subsystem, which is responsible for managing power and performance levels of devices. The issue arises when the bandwidth table is not initialized due to missing interconnect properties, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability exists in the OPP subsystem where calling the functions dev_pm_opp_find_bw_ceil or dev_pm_opp_find_bw_floor can lead to a kernel crash if the bandwidth table has not been initialized. This occurs when the interconnect properties are missing in the OPP consumer node, resulting in a NULL pointer dereference. The crash manifests as an inability to handle a kernel NULL pointer dereference at a specific virtual address, leading to a system halt. The technical details indicate that the crash occurs during the execution of the _read_bw function, which attempts to access the bandwidth data without confirming the existence of the bandwidth table.
How To Fix
Minimum fixed version
6.1.129-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the bandwidth table is properly initialized before calling the dev_pm_opp_find_bw_ceil or dev_pm_opp_find_bw_floor functions. This can be done by checking the interconnect properties in the OPP consumer node and creating the bandwidth table if it is missing.
Conclusion
The vulnerability identified in the Linux kernel regarding the OPP subsystem poses a significant risk of system crashes due to uninitialized bandwidth tables. Users are strongly advised to update their systems to the latest patched versions to mitigate this risk. Additionally, temporary workarounds can be implemented to prevent crashes until an update can be performed.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a kernel crash, causing system instability and potential data loss.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary symptom is a kernel crash that results in an inability to handle a NULL pointer dereference, leading to system halts.
Yes, the vulnerability affects specific versions of the Linux kernel in Debian 12 and Debian 13 where the OPP subsystem is utilized.
If an immediate update is not possible, ensure that the bandwidth table is initialized correctly as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
