NULL pointer dereference in Linux kernel mediatek mt8188

1) NULL pointer dereference

EUVDB-ID: #VU102095

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56685

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mt8195_mt6359_soc_card_probe() function in sound/soc/mediatek/mt8195/mt8195-mt6359.c, within the mt8192_mt6359_legacy_probe() and mt8192_mt6359_soc_card_probe() functions in sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c, within the mt8188_mt6359_soc_card_probe() function in sound/soc/mediatek/mt8188/mt8188-mt6359.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/2f2020327cc8561d7c520d2f2d9acea84fa7b3a3
https://git.kernel.org/stable/c/376f4800f34a28def026ff5c5d4fc5e54e1744ff
https://git.kernel.org/stable/c/550279449ff54c5aa28cfca5c567308cbfb145f0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.