NULL pointer dereference in Intel Optane Persistent Memory (PMem) - CVE-2024-36275

Vulnerability identifier: #VU100522

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-36275

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Intel Optane Persistent Memory (PMem)
ThinkAgile VX7520
ThinkServer SR668 V2
ThinkServer SR660 V2
ThinkServer SR590/SR588
ThinkServer SR590 V2
ThinkServer SR588 V2
ThinkServer DN8848 V2
ThinkEdge SE450
ThinkAgile VX7820
ThinkAgile VX7531 Certified Node
ThinkAgile VX7530 Appliance
ThinkAgile VX7520 N
ThinkServer SR860P
Thinkagile VX7330 Appliance
ThinkAgile VX7320 N
ThinkAgile VX650 V2 DPU Certified Node
ThinkAgile VX5530 Appliance
ThinkAgile VX5520
ThinkAgile VX3720
ThinkAgile VX3530-G Appliance
ThinkAgile VX3520-G
ThinkAgile VX3330 Appliance
ThinkAgile VX3320
ThinkSystem SR650
WH5900 Appliance
ThinkSystem ST658 V2
ThinkSystem ST650 V2
ThinkSystem SR950
ThinkSystem SR860 V2
ThinkSystem SR860
ThinkSystem SR850P
ThinkSystem SR850 V2
ThinkSystem SR850
ThinkSystem SR670 V2
ThinkSystem SR650 V2
ThinkAgile VX2330 Appliance
ThinkSystem SR630 V2
ThinkSystem SR630
ThinkSystem SR590
ThinkSystem SR570
ThinkSystem SN850
ThinkSystem SN550 V2
ThinkSystem SN550
ThinkSystem SD650 DWC Dual Node Tray
ThinkSystem SD530
ThinkStation P920 Rack Workstation
ThinkAgile HX2331 Certified Node
ThinkAgile HX5520 Appliance
ThinkAgile HX3721 Certified Node
ThinkAgile HX3720 Appliance
ThinkAgile HX3521-G Certified Node
ThinkAgile HX3520-G Appliance
ThinkAgile HX3331 Node SAP HANA
ThinkAgile HX3331 Certified Node
ThinkAgile HX3330 Appliance
ThinkAgile HX3321 Certified Node
ThinkAgile HX3320 Appliance
ThinkAgile HX2720-E Appliance
ThinkAgile HX5520-C Appliance
ThinkAgile HX2330 Appliance
ThinkAgile HX2321 Certified Node
ThinkAgile HX2320-E Appliance
ThinkAgile HX2320 Appliance
ThinkAgile HX1521-R Certified Node
ThinkAgile HX1520-R Appliance
ThinkAgile HX1331 Certified Node
ThinkAgile HX1321 Certified Node
ThinkAgile HX1320 Appliance
ThinkAgile VX3331 Certified Node
ThinkAgile MX 1U - MX3321 F
ThinkAgile VX2320
ThinkAgile VX 4U Certified Node
ThinkAgile VX 2U4N Certified Node
ThinkAgile VX 2U Certified Node
ThinkAgile VX 1U Certified Node
ThinkAgile MX Certified Node – Hybrid
ThinkAgile MX Certified Node – All Flash
ThinkAgile MX3520 H Appliance - Hybrid
ThinkAgile MX3520 F Appliance - All flash
ThinkAgile MX 1U - MX3321 H
ThinkAgile HX5530 Appliance
ThinkAgile HX7821 Certified Node
ThinkAgile HX7820 Appliance
ThinkAgile HX7531 Node SAP HANA
ThinkAgile HX7531 Certified Node
ThinkAgile HX7530 Appl for SAP HANA
ThinkAgile HX7521 Certified Node
ThinkAgile HX7520 Appliance
ThinkAgile HX5531 Certified Node
ThinkAgile HX5521-C Certified Node
ThinkAgile HX5521 Certified Node
Lenovo Persistent Memory FW update for Windows/Linux
Lenovo Persistent Memory FW update for Windows/Linux (For Linux)
Lenovo Persistent Memory FW update for Windows/Linux (For Windows)
Lenovo Persistent Memory FW update (For Linux)
Lenovo Persistent Memory Module Linux Firmware
Lenovo Persistent Memory Module Windows Firmware
Intel Persistent Memory Persistent Memory Module Windows Firmware
Lenovo Persistent Memory FW update (For Windows)
Intel Persistent Memory Persistent Memory Module Linux Firmware

Install update from vendor's website.

Intel Optane Persistent Memory (PMem) - addressed in versions CR_MGMT_02.00.00.4040, CR_MGMT_03.00.00.0499
Lenovo Persistent Memory FW update for Windows/Linux - update to DCPMM-01.02.00.5446-4 AND DCPMM-01.02.00.5446-4-A
Lenovo Persistent Memory FW update for Windows/Linux (For Linux) - update to DCPMM-01.02.00.5446-4 AND DCPMM-01.02.00.5446-4-A
Lenovo Persistent Memory FW update for Windows/Linux (For Windows) - update to DCPMM-01.02.00.5446-4 AND DCPMM-01.02.00.5446-4-A
Lenovo Persistent Memory FW update (For Linux) - update to PM200-02.02.00.1553-8
Lenovo Persistent Memory Module Linux Firmware - update to PM200-02.02.00.1553-8
Lenovo Persistent Memory Module Windows Firmware - update to PM200-02.02.00.1553-8
Intel Persistent Memory Persistent Memory Module Windows Firmware - update to PM200-02.02.00.1553-8
Lenovo Persistent Memory FW update (For Windows) - update to PM200-02.02.00.1553-8
Intel Persistent Memory Persistent Memory Module Linux Firmware - update to PM200-02.02.00.1553-8

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01189.html

• NULL pointer dereference in Intel Optane PMem Management Software
• Lenovo update for Intel Optane PMem Management software