CVE-2024-58011 platform/x86: int3472: Check for adev == NULL
A missing NULL check in the int3472 driver allows a local attacker to cause a kernel crash by manually binding the driver to a device without an ACPI companion.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-58011?
CVE-2024-58011 is a medium-severity vulnerability in Linux kernel, published on 27 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: int3472: Check for adev == NULL
Not all devices have an ACPI companion fwnode, so adev might be NULL. This can e.g. (theoretically) happen when a user manually binds one of the int3472 drivers to another i2c/platform device through sysfs.
Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in skl_int3472_get_acpi_buffer().
Weakness: CWE-476
Which versions are affected by CVE-2024-58011?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-58011?
Apply the vendor's patch.
Is CVE-2024-58011 being exploited?
There is no known exploitation of CVE-2024-58011 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-57837, BELL-CVE-2024-58011, DEBIAN-CVE-2024-58011, GHSA-jcx5-2hxr-pwq4, ROOT-OS-UBUNTU-2204-CVE-2024-58011, ROOT-OS-UBUNTU-2404-CVE-2024-58011 and 1 more.