CVE-2024-58011
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In the Linux kernel, the int3472 driver for x86 platforms lacked a check for a NULL adev (ACPI device) pointer. This could theoretically occur when a user manually binds the driver to an i2c/platform device via sysfs, leading to a possible NULL pointer dereference in skl_int3472_get_acpi_buffer().
Risk Assessment
The risk involves a potential system crash (kernel panic) or undefined behavior due to NULL pointer dereference, which could be exploited for DoS attacks or potentially privilege escalation under specific conditions.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit adding the adev == NULL check). For production systems, apply the security patch from your distributor.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: platform/x86: int3472: Check for adev == NULL Not all devices have an ACPI companion fwnode, so adev might be NULL. This can e.g. (theoretically) happen when a user manually binds one of the int3472 drivers to another i2c/platform device through sysfs. Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in skl_int3472_get_acpi_buffer().