NULL pointer dereference in Linux kernel riscv kvm



| Updated: 2025-05-12
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2024-47717
CWE-ID CWE-476
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) NULL pointer dereference

EUVDB-ID: #VU98990

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47717

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the kvm_riscv_vcpu_pmu_read_hpm() function in arch/riscv/kvm/vcpu_pmu.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.10 - 6.11.1

CPE2.3 External links

https://git.kernel.org/stable/c/81aa95fd5bd14ff49617f07fa79a8d1f1cf2ce9a
https://git.kernel.org/stable/c/6d0a5dcfc78bd18f2abb9641f83380135494559b
https://git.kernel.org/stable/c/47d40d93292d9cff8dabb735bed83d930fa03950
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.13
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.2
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###