Junglewise Threat Intelligence

CVE-2024-58020: Linux Kernel NULL pointer dereference in HID multitouch driver

CVE-2024-58020 · Severity: medium · CVSS 5.5 · Published 2025-02-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's multitouch input driver. Under specific low-memory conditions, the system may fail to properly handle input device naming, leading to a system crash (kernel panic). This could allow a local user to cause a denial-of-service, impacting the availability of the affected system.

Technical details

A NULL pointer dereference vulnerability exists in the mt_input_configured() function within drivers/hid/hid-multitouch.c. The root cause is a missing check for the return value of devm_kasprintf(), which can return NULL upon memory allocation failure. An attacker with local access could potentially trigger this condition to cause a kernel panic (Denial of Service). The issue has been resolved by adding the necessary NULL check and returning -ENOMEM on failure. Patches are available across multiple stable kernel branches including 4.14.y, 4.19.y, 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.12.y, and 6.13.y.

Affected products

  • Linux Linux Kernel 4.14.326 to 4.15, 4.19.295 to 4.20, 5.4.257 to 5.5, 5.10.195 to 5.11, 5.15.132 to 5.16, 6.1.53 to 6.1.129, 6.4.16 to 6.5, 6.5.3 to 6.6.79, 6.7 to 6.12.16, 6.13 to 6.13.4

Timeline

  • 2024-11-15: other: Vulnerability fixed in source code
  • 2025-02-26: advisory: NVD published the CVE record
  • 2025-02-27: disclosed: Public disclosure of the vulnerability details

References

Related threats