Critical NULL-Pointer Dereference in Linux Kernel - linux Package Vulnerability
Summary
DEBIAN-CVE-2024-53069: In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: fix a NULL-pointer dereference Some SCM calls can be invoked with __scm being NULL (the driver may not have been and will not be pr... Affects linux versions < 6.11.9-1. Fixed in 6.11.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for enabling the execution of applications and ensuring system stability. The vulnerability in question affects versions of the linux package in Debian 13 and 14, specifically related to the Qualcomm SCM firmware, which can lead to system crashes or unexpected behavior if not addressed.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the firmware for Qualcomm SCM, where certain SCM calls can be made with a NULL pointer. This occurs when the driver is not properly probed due to the absence of an SCM entry in the device-tree. Dereferencing a NULL pointer can lead to system crashes, data corruption, or other unpredictable behaviors, posing a significant risk to system integrity and reliability.
How To Fix
Minimum fixed version
6.11.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate risks.
Conclusion
The identified vulnerability in the linux package poses a significant risk to systems running Debian 13 and 14. It is essential for users to update their packages to the fixed version to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL-pointer dereference in the Linux kernel's Qualcomm SCM firmware, which can lead to system instability.
The vulnerability affects the linux package in Debian 13 and 14, specifically versions prior to 6.11.9-1.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability can cause system crashes, data corruption, and other unpredictable behaviors, compromising system integrity.
Currently, there are no specific workarounds available. It is crucial to apply the patch as soon as it is available.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
