CVE-2024-42235CWE-476

CVE-2024-42235

High · published August 7, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

s390/mm: Add NULL pointer check to crst_table_free() base_crst_free()

crst_table_free() used to work with NULL pointers before the conversion

to ptdescs. Since crst_table_free() can be called with a NULL pointer

(error handling in crst_table_upgrade() add an explicit check.

Also add the same check to base_crst_free() for consistency reasons.

In real life this should not happen, since order two GFP_KERNEL

allocations will not fail, unless FAIL_PAGE_ALLOC is enabled and used.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00220 · 11.9th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2024-08-07T20:15Z
Affected products (2)
ProductVersionsFixed in
linux/linux_kernel≥ 6.6, < 6.6.416.6.41
linux/linux_kernel≥ 6.7, < 6.9.106.9.10
References (3)
EPSS history
Timeline
  • 07 AUG 15:14Z
    s390/mm: Add NULL pointer check to crst_table_free() base_crst_free()
    cvelistv5