Kernel Vulnerability in Linux Package: Potential NULL Pointer Dereference in Power Domain Management
Summary
DEBIAN-CVE-2024-58081: In the Linux kernel, the following vulnerability has been resolved: clk: mmp2: call pm_genpd_init() only after genpd.name is set Setting the genpd's struct device's name with dev_set_name() is happening within pm_genpd_i... Affects linux versions < 6.12.15-1. Fixed in 6.12.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for process management, memory management, device drivers, and system calls. This vulnerability affects the power management subsystem, specifically in the handling of generic power domains (genpd), which can lead to system instability if not addressed.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where the function pm_genpd_init() is called before the name of the generic power domain (genpd) device is set. This can lead to a NULL pointer dereference when the system attempts to create the device filesystem hierarchy for the power domain. The issue originates from a change in commit 899f44531fe6, which altered how the genpd's name is managed. If the name remains NULL, it can cause a crash, resulting in system instability and potential data loss.
How To Fix
Minimum fixed version
6.12.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk to system stability due to a NULL pointer dereference in power domain management. Users are urged to update to the patched version to mitigate these risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a potential NULL pointer dereference in the Linux kernel's power management subsystem, which can lead to system crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Failure to address this vulnerability may result in system instability, crashes, and potential data loss during power domain management operations.
Yes, the vulnerability is fixed in version 6.12.15-1 of the Linux package.
While there are no specific workarounds, it is advisable to monitor your system closely for any signs of instability and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
