Critical Vulnerability in Linux Package: NULL Pointer Dereference in GPIO Handling
Summary
DEBIAN-CVE-2024-50224: In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-dspi: Fix crash when not using GPIO chip select Add check for the return value of spi_get_csgpiod() to avoid passing a NULL pointer to gpio... Affects linux versions < 6.11.7-1. Fixed in 6.11.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux package is a core component of the Debian operating system, responsible for managing hardware interactions and system resources. It provides essential functionalities for device drivers, file systems, and process management. This package is crucial for system stability and performance, making it a key target for vulnerabilities that could compromise system integrity.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-50224 arises from a NULL pointer dereference in the GPIO handling code of the Linux kernel. Specifically, the issue occurs in the spi-fsl-dspi driver when the GPIO chip select is not used, leading to a crash. This vulnerability can result in system instability, causing unexpected reboots or crashes, which may affect the availability of services running on the affected systems. The technical details indicate that the crash is triggered by the failure to check the return value of the spi_get_csgpiod() function, allowing a NULL pointer to be passed to gpiod_direction_output().
How To Fix
Minimum fixed version
6.11.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the GPIO chip select feature in the spi-fsl-dspi driver until the package is updated. This may prevent the crash from occurring, but it is recommended to apply the patch as soon as possible for full protection.
Conclusion
The vulnerability DEBIAN-CVE-2024-50224 in the Linux package poses a significant risk due to its potential to cause system crashes. It is crucial for users to update to the patched version 6.11.7-1 to ensure system stability and security. Temporary workarounds are available, but applying the patch is the best course of action.
See every vulnerability recorded for linux →
FAQ
DEBIAN-CVE-2024-50224 is a vulnerability in the Linux kernel that can cause a system crash due to a NULL pointer dereference in GPIO handling.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to system instability, causing unexpected crashes or reboots, which may disrupt services and affect system performance.
Yes, the patch is available in version 6.11.7-1 of the Linux package. Users should update to this version to mitigate the vulnerability.
If you cannot update immediately, avoid using the GPIO chip select feature in the spi-fsl-dspi driver as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
