#VU105002 NULL pointer dereference in Linux kernel - CVE-2024-57834

Vulnerability identifier: #VU105002

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-57834

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vidtv_start_streaming() and vidtv_stop_streaming() functions in drivers/media/test-drivers/vidtv/vidtv_bridge.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/1221989555db711578a327a9367f1be46500cb48
https://git.kernel.org/stable/c/2c5601b99d79d196fe4a37159e3dfb38e778ea18
https://git.kernel.org/stable/c/86307e443c5844f38e1b98e2c51a4195c55576cd
https://git.kernel.org/stable/c/904a8323cc8afa7eb9ce3e67303a2b3f2f787306
https://git.kernel.org/stable/c/95432a37778c9c5dd105b7b9f19e9695c9e166cf

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.