#VU98968 NULL pointer dereference in Linux kernel - CVE-2024-49871

Vulnerability identifier: #VU98968

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49871

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the adp5589_keypad_add() and adp5589_probe() functions in drivers/input/keyboard/adp5589-keys.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/4449fedb8a710043fc0925409eba844c192d4337
https://git.kernel.org/stable/c/34e304cc53ae5d3c8e3f08b41dd11e0d4f3e01ed
https://git.kernel.org/stable/c/7c3f04223aaf82489472d614c6decee5a1ce8d7f
https://git.kernel.org/stable/c/9a38791ee79bd17d225c15a6d1479448be127a59
https://git.kernel.org/stable/c/122b160561f6429701a0559a0f39b0ae309488c6
https://git.kernel.org/stable/c/fb5cc65f973661241e4a2b7390b429aa7b330c69

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.