Critical NULL Pointer Dereference in Linux Kernel's Clock Management - CVE-2024-58076
Summary
CVE-2024-58076: In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-sm6350: Add missing parent_map for two clocks If a clk_rcg2 has a parent, it should also have parent_map defined, otherwise we'll get a N... Affects linux versions < 6.1.129-1. Fixed in 6.1.129-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management, process scheduling, and system calls. It is widely used in various environments, from servers to embedded systems. This vulnerability affects the clock management subsystem, specifically in Qualcomm's clock configuration, which is crucial for managing the frequency and performance of hardware components.
Vulnerability Detail
CVE-2024-58076 is a vulnerability in the Linux kernel related to the clock management subsystem. It arises when a clk_rcg2 clock has a parent but lacks a defined parent_map. This oversight can lead to a NULL pointer dereference during the execution of the clk_set_rate function, potentially causing system crashes or instability. The vulnerability is triggered when the system attempts to set the clock rate without the necessary mapping, leading to a call trace that indicates the failure points in the kernel's clock management code.
How To Fix
Minimum fixed version
6.1.129-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2024-58076 is a critical vulnerability in the Linux kernel that can lead to system instability due to a NULL pointer dereference in the clock management subsystem. Users are urged to update their systems promptly to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2024-58076 is a vulnerability in the Linux kernel's clock management subsystem that can lead to a NULL pointer dereference, potentially causing system crashes.
If your system uses a clk_rcg2 clock without a defined parent_map, it may experience crashes or instability when attempting to set clock rates.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is recommended to monitor the situation and apply the patch as soon as it is available.
Detailed information can be found in the official CVE database and through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
