Critical NULL Dereference Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-50009: In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value cpufreq_cpu_get may return NULL. Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting its reliability and security. This specific vulnerability affects the cpufreq subsystem, which manages CPU frequency scaling, particularly for AMD processors.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the cpufreq subsystem related to the amd-pstate driver. The function cpufreq_cpu_get may return a NULL value, leading to a potential NULL dereference. This can cause system crashes or unpredictable behavior if not handled correctly. The vulnerability was discovered by the Linux Verification Center and highlights the importance of validating return values in kernel code to maintain system stability.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate any risks associated with the NULL dereference.
Conclusion
The identified vulnerability in the Linux kernel's cpufreq subsystem poses a significant risk of system instability due to potential NULL dereference. It is crucial for users to update their systems to the patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or unpredictable behavior due to a NULL dereference in the cpufreq subsystem.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The vulnerability affects versions prior to 6.11.4-1 of the Linux package in both Debian 13 and Debian 14.
While the primary risk is system instability, it is always advisable to back up important data before applying updates or patches.
Regularly check for updates and vulnerabilities, ideally on a weekly basis, to ensure your system remains secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
