CVE-2024-27038: clk: Fix clk_core_get NULL dereference
In the Linux kernel, the following vulnerability has been resolved:
clk: Fix clkcoreget NULL dereference
It is possible for clkcoreget to dereference a NULL in the following sequence:
clkcoreget() ofclkgethwfromclkspec() ofclkgethwfromprovider() clkgethw()
clkgethw() can return NULL which is dereferenced by clkcoreget() at hw->core.
Prior to commit dde4eff47c82 ("clk: Look for parents with clkdev based clklookups") the check ISERRORNULL() was performed which would have caught the NULL.
Reading the description of this function it talks about returning NULL but that cannot be so at the moment.
Update the function to check for hw before dereferencing it and return NULL if hw is NULL.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
clk: Fix clkcoreget NULL dereference
The Linux kernel CVE team has assigned CVE-2024-27038 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050112-CVE-2024-27038-3af3@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27038?
CVE-2024-27038 has been identified as a significant vulnerability due to its potential for causing a NULL dereference in the Linux kernel.
How do I fix CVE-2024-27038?
To remediate CVE-2024-27038, upgrade to the kernel version 5.4.273 or newer, 5.10.214 or newer, 5.15.153 or newer, 6.1.83 or newer, 6.6.23 or newer, 6.7.11 or newer, 6.8.2, or 6.9.
Which systems are affected by CVE-2024-27038?
CVE-2024-27038 affects various versions of the Linux kernel from 5.2 up to 6.9 and specific Debian Linux version 10.0.
What is the impact of CVE-2024-27038?
The impact of CVE-2024-27038 includes possible system crashes or instability due to NULL pointer dereference.
Has CVE-2024-27038 been resolved?
Yes, CVE-2024-27038 has been resolved through patches in the updated kernel versions listed in the remediation section.