Null Pointer Dereference in NVIDIA Shield LED Initialization - Linux Package Vulnerability
Summary
DEBIAN-CVE-2024-26770: In the Linux kernel, the following vulnerability has been resolved: HID: nvidia-shield: Add missing null pointer checks to LED initialization devm_kasprintf() returns a pointer to dynamically allocated memory which can b... Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. It is widely used across various distributions, including Debian. This vulnerability specifically affects the NVIDIA Shield LED initialization process, where a missing null pointer check can lead to potential system instability or crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the HID (Human Interface Device) subsystem related to the NVIDIA Shield. The issue arises from the lack of null pointer checks during the LED initialization process. The function devm_kasprintf() can return a NULL pointer if memory allocation fails, which, if not properly checked, can lead to dereferencing a NULL pointer. This can result in unexpected behavior, including crashes or system instability, particularly when the affected functionality is invoked.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel related to the NVIDIA Shield LED initialization poses a risk of system instability due to a missing null pointer check. Users are advised to update to the patched version to mitigate this risk effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a null pointer dereference in the NVIDIA Shield LED initialization process within the Linux kernel.
If exploited, this vulnerability can lead to system crashes or instability when the affected functionality is used.
Yes, a patch is available in version 6.7.7-1 of the Linux package.
You can check if your application is affected by using the Vulert playground at Vulert Scanner without any signup.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
