Critical NULL Pointer Dereference Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-38584: In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe() In the prueth_probe() function, if one of the calls to emac_phy_connect() fails du... Affects linux versions < 6.8.12-1. Fixed in 6.8.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used in various environments, from servers to embedded systems. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically in the 'linux' package, which is crucial for system operations and stability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the 'prueth_probe()' function within the net subsystem. If the function 'emac_phy_connect()' fails and returns NULL, the subsequent call to 'phy_attached_info()' will attempt to dereference this NULL pointer, leading to a potential system crash or undefined behavior. This vulnerability can be exploited by attackers to disrupt system operations, making it critical to address.
How To Fix
Minimum fixed version
6.8.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating the package as mentioned above.
Conclusion
The identified NULL pointer dereference vulnerability in the Linux kernel poses significant risks to system stability and security. It is crucial for users to update their systems to the patched version to mitigate these risks effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the Linux kernel, which can lead to system crashes.
The vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically before version 6.8.12-1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Currently, there are no known workarounds. The recommended action is to update to the patched version.
Detailed information can be found in the Debian CVE database or by visiting the Vulert website for real-time monitoring.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
