Kernel Vulnerability in Linux Package: NULL Pointer Dereference in winwing_init_led()
Summary
DEBIAN-CVE-2024-58021: In the Linux kernel, the following vulnerability has been resolved: HID: winwing: Add NULL check in winwing_init_led() devm_kasprintf() can return a NULL pointer on failure,but this returned value in winwing_init_led() i... Affects linux versions < 6.12.16-1. Fixed in 6.12.16-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used in various distributions, including Debian. The kernel is known for its stability and performance, but like any complex software, it can have vulnerabilities. This specific issue affects the HID (Human Interface Device) subsystem, particularly the winwing driver, which is responsible for handling input from certain gaming peripherals.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the HID subsystem, specifically within the winwing driver. The function winwing_init_led() does not adequately check for NULL pointers returned by devm_kasprintf(). If this function fails and returns NULL, the subsequent use of this pointer can lead to a kernel NULL pointer dereference, potentially causing system crashes or instability. This vulnerability could be exploited by attackers to disrupt system operations or execute arbitrary code with elevated privileges.
How To Fix
Minimum fixed version
6.12.16-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel's HID subsystem poses a significant risk due to potential system instability and exploitation. Users are strongly advised to update to the patched version 6.12.16-1 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to kernel crashes or instability due to NULL pointer dereference, potentially allowing attackers to disrupt system operations.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The vulnerability affects all versions of the Linux package prior to 6.12.16-1 in Debian 13 and Debian 14.
Yes, if left unpatched, this vulnerability could be exploited by attackers to cause system instability or execute arbitrary code.
While there are no specific workarounds, it is crucial to prioritize updating your system to the patched version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
