PT-2024-9286 · Linux+3 · Linux Kernel+3

Syzbot · Published 2024-06-19 · Updated 2025-01-08 · CVE-2021-47612

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.16.0-rc4-01180-g2a987e65025e-dirty

Description: The issue is related to a null pointer dereference in the Linux kernel's NFC component. When kmalloc in nfc genl dump devices() fails, nfc genl dump devices done() segfaults. This can lead to a denial of service. The vulnerability is caused by a null pointer dereference in the range [0x0000000000000008-0x000000000000000f]. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations: To resolve the issue, update the Linux kernel to a version that includes the fix for the null pointer dereference in the NFC component. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2024-10974

CVE-2021-47612

OESA-2024-1895

OPENSUSE-SU-2024_2362-1

OPENSUSE-SU-2024_2372-1

OPENSUSE-SU-2024_2394-1

SUSE-SU-2024:2362-1

SUSE-SU-2024:2372-1

SUSE-SU-2024:2384-1

SUSE-SU-2024:2394-1

SUSE-SU-2024:2902-1

SUSE-SU-2024:2929-1

SUSE-SU-2024:2939-1

SUSE-SU-2024:4100-1

SUSE-SU-2025:0034-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 1502

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/vmwgfx_fd_priv_esc.rb · Exploit
• https://git.kernel.org/stable/c/2a8845b9603c545fddd17862282dc4c4ce0971e3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-40904 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47612 · Vendor Advisory
• https://git.kernel.org/stable/c/6644989642844de830f9b072cd65c553cb55946c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-39499 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48856 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48775 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48788 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-40941 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-41007 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-40968 · Security Note
• https://git.kernel.org/stable/c/d89e4211b51752daf063d638af50abed2fd5f96d · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2384-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48855 · Security Note