NULL pointer dereference in Linux kernel - CVE-2024-27037
Published: May 31, 2024 / Updated: May 14, 2025
Vulnerability identifier: #VU90523
CSH Severity: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-27037
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Linux kernel
Linux kernel
Software vendor:
Linux Foundation
Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference within the SLCR_SWDT_CLK_SEL() and zynq_clk_setup() functions in drivers/clk/zynq/clkc.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
External links
- https://git.kernel.org/stable/c/01511ac7be8e45f80e637f6bf61af2d3d2dee9db
- https://git.kernel.org/stable/c/8c4889a9ea861d7be37463c10846eb75e1b49c9d
- https://git.kernel.org/stable/c/0801c893fd48cdba66a3c8f44c3fe43cc67d3b85
- https://git.kernel.org/stable/c/ca976c6a592f789700200069ef9052493c0b73d8
- https://git.kernel.org/stable/c/58a946ab43501f2eba058d24d96af0ad1122475b
- https://git.kernel.org/stable/c/7938e9ce39d6779d2f85d822cc930f73420e54a6
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.153
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.83
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.23
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.11
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.2