Junglewise Threat Intelligence

CVE-2024-38615: Linux Kernel NULL pointer dereference in cpufreq

CVE-2024-38615 · Severity: medium · CVSS 5.5 · Published 2024-06-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's CPU frequency management component could allow a local user to crash the system. The issue occurs when the system attempts to shut down or reconfigure processor power settings and encounters an unexpected empty instruction. This results in a system failure (denial of service), potentially disrupting operations or causing data loss for unsaved work.

Technical details

A NULL pointer dereference vulnerability exists in drivers/cpufreq/cpufreq.c within the Linux kernel. The root cause is the lack of a validation check for the optional exit() callback before invocation during CPU offline or removal procedures. An attacker with local access could trigger this condition to cause a kernel panic and denial of service. The fix introduces a check for the exit() pointer and ensures the freq_table pointer is cleared regardless of the callback's presence. Patches have been backported to multiple stable kernel branches including 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.8.y, and 6.9.y.

Affected products

  • Linux Linux Kernel 5.1 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.8.12, 6.9 to 6.9.3

Timeline

  • 2024-06-19: disclosed
  • 2024-06-19: advisory

References

Related threats