Executive brief
A vulnerability in the Linux kernel's Precision Time Protocol (PTP) subsystem could allow a local user to crash the system. The issue occurs because certain time-keeping drivers do not properly handle specific configuration requests, leading to a system failure (NULL pointer dereference). This impacts system availability but does not directly expose sensitive data.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's PTP (Precision Time Protocol) subsystem. The root cause is that ioctl and sysfs handlers unconditionally call the 'enable' callback function without verifying if the underlying driver has implemented it. Local attackers with access to these interfaces can trigger the dereference in drivers that lack this callback (such as ptp_s390, ptp_vclock, and ptp_mock), resulting in a kernel panic. The fix introduces a dummy callback to safely handle these calls when a driver-specific implementation is missing.
Affected products
- Linux Linux Kernel versions before 6.13.3, 6.12.14, 6.6.78, 6.1.129
Timeline
- 2025-01-23: other: Patch authored
- 2025-02-27: disclosed: CVE published
- 2025-02-27: advisory
References
- https://git.kernel.org/stable/c/1334c64a5d1de6666e0c9f984db6745083df1eb4
- https://git.kernel.org/stable/c/5d1041c76de656f9f8d5a192218039a9acf9bd00
- https://git.kernel.org/stable/c/755caf4ee1c615ee5717862e427124370f46b1f3
- https://git.kernel.org/stable/c/81846070cba17125a866e8023c01d3465b153339
- https://git.kernel.org/stable/c/8441aea46445252df5d2eed6deb6d5246fc24002
- https://git.kernel.org/stable/c/9df3a9284f39bfd51a9f72a6a165c79e2aa5066b
- https://git.kernel.org/stable/c/fd53aa40e65f518453115b6f56183b0c201db26b