Critical Vulnerability in Linux Kernel: NULL-Pointer Dereference in qcom_scm_get_tzmem_pool
Summary
DEBIAN-CVE-2024-57852: In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: smc: Handle missing SCM device Commit ca61d6836e6f ("firmware: qcom: scm: fix a NULL-pointer dereference") makes it explicit that q... Affects linux versions < 6.12.16-1. Fixed in 6.12.16-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, like any complex software, it is susceptible to vulnerabilities. This specific issue affects the Qualcomm SCM (Secure Control Module) firmware interface, which is crucial for managing secure memory pools in Qualcomm hardware.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Qualcomm SCM firmware interface. The issue arises from the function qcom_scm_get_tzmem_pool(), which can return a NULL pointer. This oversight can lead to a NULL-pointer dereference, potentially causing system crashes or unexpected behavior in applications relying on this functionality. The vulnerability is documented in commit ca61d6836e6f, which explicitly addresses the need for users of this function to handle the NULL return value appropriately.
How To Fix
Minimum fixed version
6.12.16-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, ensuring that the software is updated to the latest version is the best practice to mitigate risks associated with vulnerabilities.
Conclusion
The identified vulnerability in the Linux kernel related to the Qualcomm SCM firmware interface poses a significant risk due to the potential for system crashes. Users are strongly advised to update to the patched version to ensure system stability and security. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL-pointer dereference in the qcom_scm_get_tzmem_pool function, which can lead to system instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability could lead to system crashes or unexpected behavior in applications that rely on the affected functionality.
Yes, a patch is available in version 6.12.16-1 of the Linux package. Users should update to this version or later.
While there are no specific workarounds, it is crucial to monitor your systems closely and plan for an update as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
