#VU105410 NULL pointer dereference in Linux kernel - CVE-2024-58051

Vulnerability identifier: #VU105410

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-58051

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ipmb_probe() function in drivers/char/ipmi/ipmb_dev_int.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.12, 6.12.1, 6.12.2, 6.12.3, 6.12.4, 6.12.5, 6.12.6, 6.12.7, 6.12.8, 6.12.9, 6.12.10, 6.12.11, 6.12.12

---

External links
https://git.kernel.org/stable/c/2378bd0b264ad3a1f76bd957caf33ee0c7945351
https://git.kernel.org/stable/c/312a6445036d692bc5665307eeafa4508c33c4b5
https://git.kernel.org/stable/c/4c9caf86d04dcb10e9fd8cd9db8eb79b5bfcc4d8
https://git.kernel.org/stable/c/a63284d415d4d114abd8be6e66a9558f3ca0702d
https://git.kernel.org/stable/c/e529fbcf1f35f5fc3c839df7f06c3e3d02579715
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.13

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.