CyberSecBulletin
CVE-2024-38605NVD status: Modified

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2024-38605 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions d7ff29a429b56f04783152ad7bbd7233b740e434, e7e0ca200772bdb2fdc6d43d32d341e87a36f811, e007476725730c1a68387b54b7629486d8a8301e as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.75% chance of exploitation within 30 days, higher than 55% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to d7ff29a429b56f04783152ad7bbd7233b740e434 or e7e0ca200772bdb2fdc6d43d32d341e87a36f811 or e007476725730c1a68387b54b7629486d8a8301e or e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92, whichever matches your release line, or a later version.
  2. Update linux_kernel to d7ff29a429b5 or e7e0ca200772 or e00747672573 or e644036a3e2b, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux81033c6b584b44514cbb16fffc26ca29a0fa6270 up to, but not including, d7ff29a429b56f04783152ad7bbd7233b740e434; 81033c6b584b44514cbb16fffc26ca29a0fa6270 up to, but not including, e7e0ca200772bdb2fdc6d43d32d341e87a36f811; 81033c6b584b44514cbb16fffc26ca29a0fa6270 up to, but not including, e007476725730c1a68387b54b7629486d8a8301e; 81033c6b584b44514cbb16fffc26ca29a0fa6270 up to, but not including, e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92; 81033c6b584b44514cbb16fffc26ca29a0fa6270 up to, but not including, c935e72139e6d523defd60fe875c01eb1f9ea5c5; 81033c6b584b44514cbb16fffc26ca29a0fa6270 up to, but not including, 6b8374ee2cabcf034faa34e69a855dc496a9ec12; 81033c6b584b44514cbb16fffc26ca29a0fa6270 up to, but not including, 39381fe7394e5eafac76e7e9367e7351138a29c1; 5.9d7ff29a429b56f04783152ad7bbd7233b740e434, e7e0ca200772bdb2fdc6d43d32d341e87a36f811, e007476725730c1a68387b54b7629486d8a8301e, e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92, c935e72139e6d523defd60fe875c01eb1f9ea5c5, 6b8374ee2cabcf034faa34e69a855dc496a9ec12
Linuxlinux_kernel81033c6b584b up to, but not including, d7ff29a429b5; 81033c6b584b up to, but not including, e7e0ca200772; 81033c6b584b up to, but not including, e00747672573; 81033c6b584b up to, but not including, e644036a3e2b; 81033c6b584b up to, but not including, c935e72139e6; 81033c6b584b up to, but not including, 6b8374ee2cab; 81033c6b584b up to, but not including, 39381fe7394e; 5.9d7ff29a429b5, e7e0ca200772, e00747672573, e644036a3e2b, c935e72139e6, 6b8374ee2cab

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCNA
CVSS 3.18.8HighCISA (ADP)

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix NULL module pointer assignment at card init The commit 81033c6b584b ("ALSA: core: Warn on empty module") introduced a WARN_ON() for a NULL module pointer passed at snd_card object creation, and it also wraps the code around it with '#ifdef MODULE'. This works in most cases, but the devils are always in details. "MODULE" is defined when the target code (i.e. the sound core) is built as a module; but this doesn't mean that the caller is also built-in or not. Namely, when only the sound core is built-in (CONFIG_SND=y) while the driver is a module (CONFIG_SND_USB_AUDIO=m), the passed module pointer is ignored even if it's non-NULL, and card->module remains as NULL. This would result in the missing module reference up/down at the device open/close, leading to a race with the code execution after the module removal. For addressing the bug, move the assignment of card->module again out of ifdef. The WARN_ON() is still wrapped with ifdef because the module can be really NULL when all sound drivers are built-in. Note that we keep 'ifdef MODULE' for WARN_ON(), otherwise it would lead to a false-positive NULL module check. Admittedly it won't catch perfectly, i.e. no check is performed when CONFIG_SND=y. But, it's no real problem as it's only for debugging, and the condition is pretty rare.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.