CVE-2024-26975: powercap: intel_rapl: Fix a NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved:
powercap: intelrapl: Fix a NULL pointer dereference
A NULL pointer dereference is triggered when probing the MMIO RAPL driver on platforms with CPU ID not listed in intelraplcommon CPU model list.
This is because the intelraplcommon module still probes on such platforms even if 'defaultsmsr' is not set after commit 1488ac990ac8 ("powercap: intelrapl: Allow probing without CPUID match"). Thus the MMIO RAPL rp->priv->defaults is NULL when registering to RAPL framework.
Fix the problem by adding sanity check to ensure rp->priv->rapldefaults is always valid.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
powercap: intelrapl: Fix a NULL pointer dereference
The Linux kernel CVE team has assigned CVE-2024-26975 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050133-CVE-2024-26975-d184@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26975?
CVE-2024-26975 is a medium severity vulnerability due to a potential NULL pointer dereference in the Linux kernel's intel_rapl driver.
How do I fix CVE-2024-26975?
To resolve CVE-2024-26975, update to the specified patched versions of the kernel which include the fixes.
Which Linux kernel versions are affected by CVE-2024-26975?
CVE-2024-26975 affects Linux kernel versions prior to 6.6.24, and specific versions in the 5.10, 6.1, and 6.12 series as listed in the advisory.
What platforms are impacted by CVE-2024-26975?
CVE-2024-26975 impacts platforms with CPU IDs not listed in the intel_rapl_common CPU model list during MMIO RAPL driver probing.
Is immediate action required for CVE-2024-26975?
Yes, immediate patching is recommended for systems running affected kernel versions to avoid potential system crashes.