NULL pointer dereference in Linux kernel i2c driver

1) NULL pointer dereference

EUVDB-ID: #VU91458

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35984

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the i2c_check_for_quirks() function in drivers/i2c/i2c-core-base.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/40f1d79f07b49c8a64a861706e5163f2db4bd95d
http://git.kernel.org/stable/c/ad3c3ac7a03be3697114f781193dd3e9d97e6e23
http://git.kernel.org/stable/c/5fd72404587d7db4acb2d241fd8c387afb0a7aec
http://git.kernel.org/stable/c/5a09eae9a7db597fe0c1fc91636205b4a25d2620
http://git.kernel.org/stable/c/4e75e222d397c6752b229ed72fc4644c8c36ecde
http://git.kernel.org/stable/c/e3425674ff68dc521c57c6eabad0cbd20a027d85
http://git.kernel.org/stable/c/357c64ef1ef39b1e7cd91ab6bdd304d043702c83
http://git.kernel.org/stable/c/91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.