PT-2024-9050 · Linux+9 · Linux Kernel+9

Published 2024-04-19 · Updated 2025-09-29 · CVE-2024-38573

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to a possible null pointer dereference in the cppc cpufreq component of the Linux kernel. This can be caused by the functions cppc cpufreq get rate() and hisi cppc cpufreq get rate() being called from different places with various parameters, potentially leading to cpufreq cpu get() returning null as 'policy' in some circumstances. The Linux Verification Center (linuxtesting.org) with SVACE found this issue.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2024:5101

ALSA-2024:5102

ALSA-2024:6997

ALSA-2025_16880

BDU:2024-10732

CESA-2024_5101

CESA-2024_5102

CVE-2024-38573

INFSA-2024_5101

INFSA-2024_5102

INFSA-2024_6997

MGASA-2024-0263

MGASA-2024-0266

OPENSUSE-SU-2024_2372-1

OPENSUSE-SU-2024_2394-1

RHSA-2024:5101

RHSA-2024:5102

RHSA-2024:6744

RHSA-2024:6745

RHSA-2024:6993

RHSA-2024:6997

RHSA-2024_5101

RHSA-2024_5102

RHSA-2024_6997

RLSA-2024:5101

RLSA-2024:5102

RXSA-2024:5101

SUSE-SU-2024:2372-1

SUSE-SU-2024:2394-1

SUSE-SU-2024:2571-1

SUSE-SU-2024:2896-1

SUSE-SU-2024:2939-1

SUSE-SU-2024:2973-1

SUSE-SU-2025:20008-1

SUSE-SU-2025:20028-1

USN-6949-1

USN-6949-2

USN-6952-1

USN-6952-2

USN-6955-1

USN-7007-1

USN-7007-2

USN-7007-3

USN-7009-1

USN-7009-2

USN-7019-1

Affected Products

Almalinux

Astra Linux

Centos

Linuxmint

Linux Kernel

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 3715

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38573.json · Exploit
• https://ubuntu.com/security/CVE-2024-36891 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-41002 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-41087 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-35858 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6949-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36489 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26970 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38596 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26966 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36900 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38662 · Vendor Advisory
• https://git.kernel.org/stable/c/b18daa4ec727c0266de5bfc78e818d168cc4aedf · Patch
• https://ubuntu.com/security/CVE-2024-35896 · Vendor Advisory