Critical NULL Pointer Dereference Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-56535: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() kmalloc may fail, return value might be NULL and will cause NULL pointer derefere... Affects linux versions < 6.12.3-1. Fixed in 6.12.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various platforms, including servers, desktops, and embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes, data loss, or unauthorized access.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the wifi driver (rtw89) related to the function btc_fw_set_monreg(). The issue arises from the lack of a NULL pointer check after a memory allocation attempt using kmalloc. If kmalloc fails, it returns NULL, leading to a potential NULL pointer dereference, which can cause system instability or crashes. This vulnerability is critical as it can be exploited to disrupt the normal operation of the kernel, potentially allowing attackers to execute arbitrary code or escalate privileges.
How To Fix
Minimum fixed version
6.12.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux package.
Conclusion
The identified NULL pointer dereference vulnerability in the Linux kernel poses significant risks to system stability and security. It is essential for users to update their Linux packages to the fixed version 6.12.3-1 to protect against potential exploits. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the wifi driver of the Linux kernel, which can lead to system crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Exploitation of this vulnerability can lead to system instability, crashes, or unauthorized access to system resources.
Yes, the patched version of the Linux package is 6.12.3-1. It is recommended to update to this version.
While there are no specific workarounds, it is crucial to prioritize updating your system to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
