Critical NULL Dereference Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-58064: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: tests: Fix potential NULL dereference in test_cfg80211_parse_colocated_ap() kunit_kzalloc() may return NULL, dereferencing it without NU... Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. The kernel is known for its stability and performance, but vulnerabilities can lead to significant security risks. This specific vulnerability affects the cfg80211 subsystem, which is responsible for wireless networking in the kernel, potentially compromising system integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the cfg80211 subsystem related to the function test_cfg80211_parse_colocated_ap(). The issue arises from the use of kunit_kzalloc(), which may return a NULL pointer. If this pointer is dereferenced without a proper NULL check, it can lead to a NULL dereference, causing system crashes or unexpected behavior. This vulnerability is particularly concerning as it could be exploited by an attacker to disrupt wireless connectivity or execute arbitrary code.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround is provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
The identified NULL dereference vulnerability in the Linux kernel's cfg80211 subsystem poses significant risks to system stability and security. Users are strongly advised to update their kernel to the patched version 6.12.13-1 to mitigate these risks. Regular monitoring for vulnerabilities is essential to maintain system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or unexpected behavior due to NULL dereference, potentially allowing attackers to disrupt wireless connectivity.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. By uploading your manifest file, you can check if your application is affected by this vulnerability.
While the primary risk is system instability, there is a potential for data loss if the system crashes unexpectedly.
The vulnerability affects the Linux kernel versions prior to 6.12.13-1 in both Debian 13 and Debian 14.
It is recommended to regularly check for vulnerabilities, especially after updates or changes to your software environment. Using tools like Vulert can help automate this process.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
