CVE-2024-35800: efi: fix panic in kdump kernel
In the Linux kernel, the following vulnerability has been resolved:
efi: fix panic in kdump kernel
Check if getnextvariable() is actually valid pointer before calling it. In kdump kernel this method is set to NULL that causes panic during the kexec-ed kernel boot.
Tested with QEMU and OVMF firmware.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
efi: fix panic in kdump kernel
The Linux kernel CVE team has assigned CVE-2024-35800 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051738-CVE-2024-35800-219a@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35800?
CVE-2024-35800 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-35800?
To fix CVE-2024-35800, upgrade to kernel versions 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9, or the specified versions from Debian.
What impact does CVE-2024-35800 have on Linux systems?
CVE-2024-35800 may cause a kernel panic during the boot process of a kdump kernel.
Which Linux kernel versions are affected by CVE-2024-35800?
CVE-2024-35800 affects certain older versions of the Linux kernel up until the specified patched versions in the remediation.
Is CVE-2024-35800 exploitable remotely?
CVE-2024-35800 does not appear to have a direct remote exploit vector, as it primarily affects local kernel operations.