Critical NULL Pointer Dereference Vulnerability in Linux Kernel (CVE-2024-58080)
Summary
CVE-2024-58080: In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-sm6350: Add missing parent_map for a clock If a clk_rcg2 has a parent, it should also have parent_map defined, otherwise we'll get a N... Affects linux versions < 6.1.129-1. Fixed in 6.1.129-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, like any complex software, it can have vulnerabilities. CVE-2024-58080 specifically affects the clock management subsystem, where a missing parent_map for a clock can lead to a NULL pointer dereference, potentially causing system crashes or instability.
Vulnerability Detail
CVE-2024-58080 is a vulnerability in the Linux kernel related to the clock management subsystem. It arises when a clk_rcg2 clock has a parent but lacks a corresponding parent_map definition. This oversight can lead to a NULL pointer dereference when the clk_set_rate function is called, resulting in a system crash. The vulnerability is critical as it can affect the stability of systems relying on the affected clock configurations, leading to potential downtime or data loss.
How To Fix
Minimum fixed version
6.1.129-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2024-58080 is a critical vulnerability in the Linux kernel that can lead to system instability due to a NULL pointer dereference. Users are advised to update their kernel to the patched version to mitigate this risk. Monitoring tools like Vulert can help keep track of vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2024-58080 is a vulnerability in the Linux kernel that can lead to a NULL pointer dereference due to a missing parent_map for certain clocks.
This vulnerability can cause system crashes or instability when the affected clock configurations are used, potentially leading to downtime.
If you are using a version of the Linux kernel that has not been patched for CVE-2024-58080, your system may be vulnerable. You can check your kernel version and update it accordingly.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the patch as soon as it is available.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file. You can check if your application is affected by this vulnerability using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
