Critical NULL Dereference Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-26784: In the Linux kernel, the following vulnerability has been resolved: pmdomain: arm: Fix NULL dereference on scmi_perf_domain removal On unloading of the scmi_perf_domain module got the below splat, when in the DT provided... Affects linux versions < 6.7.9-1. Fixed in 6.7.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various devices, from servers to embedded systems. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the scmi_perf_domain module, which manages performance domains in ARM architectures.
Vulnerability Detail
In the Linux kernel, a NULL dereference vulnerability was identified in the scmi_perf_domain module during the removal process. This issue arises when the '#power-domain-cells' property is missing from the device tree (DT) provided to the system. The absence of this property causes the module to unload without proper initialization, leading to a crash due to a NULL pointer dereference. The vulnerability can result in system instability and potential denial of service, as the kernel may crash unexpectedly.
How To Fix
Minimum fixed version
6.7.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the '#power-domain-cells' property is correctly defined in the device tree to prevent the NULL dereference during the removal of the scmi_perf_domain module. However, this is not a permanent fix and updating the package is recommended.
Conclusion
The NULL dereference vulnerability in the Linux kernel poses significant risks to system stability and security. It is crucial for users of Debian 13 and 14 to update their Linux packages to the latest patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
A NULL dereference vulnerability occurs when a program attempts to access memory at a NULL pointer, leading to crashes or unexpected behavior.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
The vulnerability can lead to system crashes, instability, and denial of service, affecting the overall performance and reliability of the system.
Yes, updating to version 6.7.9-1 or later will resolve this vulnerability and ensure your system is secure.
Detailed information about this vulnerability can be found in the Debian CVE database and through security advisories related to the Linux kernel.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
