#VU90523 NULL pointer dereference in Linux kernel - CVE-2024-27037

Vulnerability identifier: #VU90523

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27037

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the SLCR_SWDT_CLK_SEL() and zynq_clk_setup() functions in drivers/clk/zynq/clkc.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/01511ac7be8e45f80e637f6bf61af2d3d2dee9db
https://git.kernel.org/stable/c/8c4889a9ea861d7be37463c10846eb75e1b49c9d
https://git.kernel.org/stable/c/0801c893fd48cdba66a3c8f44c3fe43cc67d3b85
https://git.kernel.org/stable/c/ca976c6a592f789700200069ef9052493c0b73d8
https://git.kernel.org/stable/c/58a946ab43501f2eba058d24d96af0ad1122475b
https://git.kernel.org/stable/c/7938e9ce39d6779d2f85d822cc930f73420e54a6

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.