PT-2024-36880 · Linux+7 · Linux Kernel+7
Li Zetao
·
Published
2024-12-27
·
Updated
2025-10-03
·
CVE-2024-56574
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.12.0-rc2+
Description
A null pointer dereference issue was found in the Linux kernel when using sysfs to dynamically register an i2c device. The issue occurs because the probe process of ts2020 needs to use platform data, but no platform data is available when using sysfs. This results in a null pointer being accessed. The issue was reported by KASAN when executing the command
# echo ts2020 0x20 > /sys/bus/i2c/devices/i2c-0/new device. The ts2020 probe() function is vulnerable to this issue.Recommendations
To resolve this issue, add checks to the platform data in the
ts2020 probe() function to prevent null pointer dereferences. As a temporary workaround, consider disabling the ts2020 probe() function until a patch is available. Restrict access to the vulnerable ts2020 module to minimize the risk of exploitation. Avoid using the sysfs interface to dynamically register i2c devices until the issue is resolved. Update to a version of the Linux kernel that includes the fix for this issue.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu