#VU102927 NULL pointer dereference in Linux kernel - CVE-2024-48881

Vulnerability identifier: #VU102927

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-48881

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cache_set_flush() function in drivers/md/bcache/super.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/336e30f32ae7c043fde0f6fa21586ff30bea9fe2
https://git.kernel.org/stable/c/4379c5828492a4c2a651c8f826a01453bd2b80b0
https://git.kernel.org/stable/c/5202391970ffbf81975251b3526b890ba027b715
https://git.kernel.org/stable/c/5e0e913624bcd24f3de414475018d3023f060ee1
https://git.kernel.org/stable/c/b2e382ae12a63560fca35050498e19e760adf8c0
https://git.kernel.org/stable/c/cc05aa2c0117e20fa25a3c0d915f98b8f2e78667
https://git.kernel.org/stable/c/fb5fee35bdd18316a84b5f30881a24e1415e1464

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.