PT-2024-31379 · Linux+3 · Linux Kernel+3

Marc Zyngier · Published 2024-08-09 · Updated 2025-09-29 · CVE-2024-45027

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue arises when xhci mem init() fails and calls xhci mem cleanup() to handle the damage. If the failure occurs before xhci->interrupters is allocated but after xhci->max interrupters has been set, xhci mem cleanup() unconditionally dereferences xhci->interrupters, leading to problems. The fix involves gating the interrupt freeing loop with a check on xhci->interrupters being non-NULL. This issue was found while debugging a DMA allocation issue that led the XHCI driver to this exact path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-459

CWE-476

Related Identifiers

ALSA-2025_16880

ALT-PU-2024-13260

BDU:2025-03753

CVE-2024-45027

USN-7154-1

USN-7154-2

USN-7155-1

USN-7156-1

USN-7196-1

Affected Products

Alt Linux

Linuxmint

Linux Kernel

Ubuntu

References · 642

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45027.json · Exploit
• https://ubuntu.com/security/CVE-2024-41079 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46753 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53057 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42295 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46795 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45026 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42127 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46815 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46825 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43895 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42238 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42278 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46868 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43884 · Vendor Advisory