#VU93032 NULL pointer dereference in Linux kernel - CVE-2024-38633

Vulnerability identifier: #VU93032

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38633

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the max3100_probe() and max3100_remove() functions in drivers/tty/serial/max3100.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/21a61a7fbcfdd3493cede43ebc7c4dfae2147a8b
http://git.kernel.org/stable/c/9db4222ed8cd3e50b81c8b910ae74c26427a4003
http://git.kernel.org/stable/c/e8e2a4339decad7e59425b594a98613402652d72
http://git.kernel.org/stable/c/361a92c9038e8c8c3996f8eeaa14522a8ad90752
http://git.kernel.org/stable/c/b6eb7aff23e05f362e8c9b560f6ac5e727b70e00
http://git.kernel.org/stable/c/e8a10089eddba40d4b2080c9d3fc2d2b2488f762
http://git.kernel.org/stable/c/fa84ca78b048dfb00df0ef446f5c35e0a98ca6a0
http://git.kernel.org/stable/c/712a1fcb38dc7cac6da63ee79a88708fbf9c45ec

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.