CVE-2024-38637 greybus: lights: check return of get_channel_from_mode
A missing null pointer check in the Linux kernel's greybus lights driver can cause a system crash when a specific channel is not found.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38637?
CVE-2024-38637 is a medium-severity vulnerability in Linux kernel, published on 21 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
greybus: lights: check return of get_channel_from_mode
If channel for the given node is not found we return null from get_channel_from_mode. Make sure we validate the return pointer before using it in two of the missing places.
This was originally reported in [0]: Found by Linux Verification Center (linuxtesting.org) with SVACE.
[0] https://lore.kernel.org/all/[email protected]
Weakness: CWE-476
Which versions are affected by CVE-2024-38637?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-38637?
Apply the vendor's patch.
Is CVE-2024-38637 being exploited?
There is no known exploitation of CVE-2024-38637 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-38637, DEBIAN-CVE-2024-38637, GHSA-v22f-rw8m-47vr, UBUNTU-CVE-2024-38637.