CVE-2024-49871: Input: adp5589-keys - fix NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved:
Input: adp5589-keys - fix NULL pointer dereference
We register a devm action to call adp5589clearconfig() and then pass the i2c client as argument so that we can call i2cgetclientdata() in order to get our device object. However, i2csetclientdata() is only being set at the end of the probe function which means that we'll get a NULL pointer dereference in case the probe function fails early.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49871?
CVE-2024-49871 has a moderate severity due to the potential for a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2024-49871?
To mitigate CVE-2024-49871, upgrade to the patched versions of Linux kernel specified as 5.10.223-1, 5.10.226-1, 6.1.119-1, or later.
Which versions of the Linux kernel are affected by CVE-2024-49871?
CVE-2024-49871 affects Linux kernel versions from 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.10.14, and specific 6.11 versions.
What is the impact of CVE-2024-49871 on users?
The impact of CVE-2024-49871 may allow vulnerable systems to experience crashes or unexpected behavior due to a NULL pointer dereference.
Is there a workaround for CVE-2024-49871?
Currently, the best practice is to apply the available patches, as there are no documented workarounds for CVE-2024-49871.