CVE-2024-27038 clk: Fix clk_core_get NULL dereference
A NULL pointer dereference in the Linux kernel clock subsystem can cause a system crash, requiring a kernel patch to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27038?
CVE-2024-27038 is a medium-severity vulnerability in Debian Debian Linux, published on 1 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
clk: Fix clk_core_get NULL dereference
It is possible for clk_core_get to dereference a NULL in the following sequence:
clk_core_get() of_clk_get_hw_from_clkspec() __of_clk_get_hw_from_provider() __clk_get_hw()
__clk_get_hw() can return NULL which is dereferenced by clk_core_get() at hw->core.
Prior to commit dde4eff47c82 ("clk: Look for parents with clkdev based clk_lookups") the check IS_ERR_OR_NULL() was performed which would have caught the NULL.
Reading the description of this function it talks about returning NULL but that cannot be so at the moment.
Update the function to check for hw before dereferencing it and return NULL if hw is NULL.
Weakness: CWE-476
Which versions are affected by CVE-2024-27038?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2024-27038?
Apply the vendor's patch.
Is CVE-2024-27038 being exploited?
There is no known exploitation of CVE-2024-27038 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-40337, BELL-CVE-2024-27038, DEBIAN-CVE-2024-27038, GHSA-6f8x-5hmv-67rj, UBUNTU-CVE-2024-27038.