{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-56629 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2024-56629 is a medium-severity vulnerability in Linux kernel, published on 27 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-56629 and fix it if it is affected.\n\nWhat it is: CVE-2024-56629 is a medium-severity vulnerability in Linux kernel, published on 27 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-56629 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-56629/ (Markdown: https://insights.sbomify.com/CVE-2024-56629/index.md)","id":"CVE-2024-56629","markdown":"https://insights.sbomify.com/CVE-2024-56629/index.md","name":"CVE-2024-56629","record":{"aliases":["AZL-55628","AZL-55637","BELL-CVE-2024-56629","DEBIAN-CVE-2024-56629","GHSA-vv3w-8397-5q9f","UBUNTU-CVE-2024-56629"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel HID driver","requires_auth":"low_privilege","summary":"A null pointer dereference in the Linux kernel Wacom HID driver can cause a system crash when specific devices report empty product names.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix when get product name maybe null pointer\n\nDue to incorrect dev-\u003eproduct reporting by certain devices, null\npointer dereferences occur when dev-\u003eproduct is empty, leading to\npotential system crashes.\n\nThis issue was found on EXCELSIOR DL37-D05 device with\nLoongson-LS3A6000-7A2000-DL37 motherboard.\n\nKernel logs:\n[   56.470885] usb 4-3: new full-speed USB device number 4 using ohci-pci\n[   56.671638] usb 4-3: string descriptor 0 read error: -22\n[   56.671644] usb 4-3: New USB device found, idVendor=056a, idProduct=0374, bcdDevice= 1.07\n[   56.671647] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3\n[   56.678839] hid-generic 0003:056A:0374.0004: hiddev0,hidraw3: USB HID v1.10 Device [HID 056a:0374] on usb-0000:00:05.0-3/input0\n[   56.697719] CPU 2 Unable to handle kernel paging request at virtual address 0000000000000000, era == 90000000066e35c8, ra == ffff800004f98a80\n[   56.697732] Oops[#1]:\n[   56.697734] CPU: 2 PID: 2742 Comm: (udev-worker) Tainted: G           OE      6.6.0-loong64-desktop #25.00.2000.015\n[   56.697737] Hardware name: Inspur CE520L2/C09901N000000000, BIOS 2.09.00 10/11/2024\n[   56.697739] pc 90000000066e35c8 ra ffff800004f98a80 tp 9000000125478000 sp 900000012547b8a0\n[   56.697741] a0 0000000000000000 a1 ffff800004818b28 a2 0000000000000000 a3 0000000000000000\n[   56.697743] a4 900000012547b8f0 a5 0000000000000000 a6 0000000000000000 a7 0000000000000000\n[   56.697745] t0 ffff800004818b2d t1 0000000000000000 t2 0000000000000003 t3 0000000000000005\n[   56.697747] t4 0000000000000000 t5 0000000000000000 t6 0000000000000000 t7 0000000000000000\n[   56.697748] t8 0000000000000000 u0 0000000000000000 s9 0000000000000000 s0 900000011aa48028\n[   56.697750] s1 0000000000000000 s2 0000000000000000 s3 ffff800004818e80 s4 ffff800004810000\n[   56.697751] s5 90000001000b98d0 s6 ffff800004811f88 s7 ffff800005470440 s8 0000000000000000\n[   56.697753]    ra: ffff800004f98a80 wacom_update_name+0xe0/0x300 [wacom]\n[   56.697802]   ERA: 90000000066e35c8 strstr+0x28/0x120\n[   56.697806]  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n[   56.697816]  PRMD: 0000000c (PPLV0 +PIE +PWE)\n[   56.697821]  EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\n[   56.697827]  ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)\n[   56.697831] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\n[   56.697835]  BADV: 0000000000000000\n[   56.697836]  PRID: 0014d000 (Loongson-64bit, Loongson-3A6000)\n[   56.697838] Modules linked in: wacom(+) bnep bluetooth rfkill qrtr nls_iso8859_1 nls_cp437 snd_hda_codec_conexant snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd soundcore input_leds mousedev led_class joydev deepin_netmonitor(OE) fuse nfnetlink dmi_sysfs ip_tables x_tables overlay amdgpu amdxcp drm_exec gpu_sched drm_buddy radeon drm_suballoc_helper i2c_algo_bit drm_ttm_helper r8169 ttm drm_display_helper spi_loongson_pci xhci_pci cec xhci_pci_renesas spi_loongson_core hid_generic realtek gpio_loongson_64bit\n[   56.697887] Process (udev-worker) (pid: 2742, threadinfo=00000000aee0d8b4, task=00000000a9eff1f3)\n[   56.697890] Stack : 0000000000000000 ffff800004817e00 0000000000000000 0000251c00000000\n[   56.697896]         0000000000000000 00000011fffffffd 0000000000000000 0000000000000000\n[   56.697901]         0000000000000000 1b67a968695184b9 0000000000000000 90000001000b98d0\n[   56.697906]         90000001000bb8d0 900000011aa48028 0000000000000000 ffff800004f9d74c\n[   56.697911]         90000001000ba000 ffff800004f9ce58 0000000000000000 ffff800005470440\n[   56.697916]         ffff800004811f88 90000001000b98d0 9000000100da2aa8 90000001000bb8d0\n[   56.697921]         0000000000000000 90000001000ba000 900000011aa48028 ffff800004f9d74c\n[   56.697926]         ffff8000054704e8 90000001000bb8b8 90000001000ba000 0000000000000000\n[   56.697931]         90000001000bb8d0 \n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"HID: wacom: fix when get product name maybe null pointer","id":"CVE-2024-56629","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"null_dereference","year":"2024"},"n_packages":0,"n_references":7,"next":{"headline":"ocfs2: free inode when ocfs2_get_init_inode() fails","id":"CVE-2024-56630"},"packages":[],"prev":{"headline":"LoongArch: Add architecture specific huge_pte_clear()","id":"CVE-2024-56628"},"products":["Linux"],"published":"2024-12-27","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A null pointer dereference in the Linux kernel Wacom HID driver can cause a system crash when specific devices report empty product names.","url":"https://insights.sbomify.com/CVE-2024-56629/"}