In the Linux kernel, the following vulnerability has been resolved:
of: module: prevent NULL pointer dereference in vsnprintf()
In of_modalias(), we can get passed the str and len parameters which would cause a kernel oops in vsnprintf() since it only allows passing a NULL ptr when the length is also 0. Also, we need to filter out the negative values of the len parameter as these will result in a really huge buffer since snprintf() takes size_t parameter while ours is ssize_t...
Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 15, 2025 | May 19, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel | Oct 9, 2024 | May 19, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade bpftoolUpgrade python3-perf | Nov 5, 2024 | May 19, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Dec 5, 2024 | May 19, 2024 |
| Suse | — | Upgrade kernel-64kb-livepatch-develUpgrade kernel-azure-extraUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-rtUpgrade kernel-zfcpdumpUpgrade dtb-lgUpgrade kernel-devel-azureUpgrade kernel-source-azureUpgrade dtb-qcomUpgrade dtb-apmUpgrade dtb-exynosUpgrade kernel-default-livepatchUpgrade kernel-preemptUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-develUpgrade kernel-default-extraUpgrade kernel-rt_debug-vdsoUpgrade kernel-devel-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-syms-azureUpgrade dtb-mediatekUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rtUpgrade kernel-default-manUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade dtb-broadcomUpgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-macrosUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-syms-rtUpgrade kernel-rt-develUpgrade kernel-docs-htmlUpgrade kernel-obs-qaUpgrade kernel-default-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-default-develUpgrade dtb-freescaleUpgrade kernel-symsUpgrade dtb-amazonUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-rtUpgrade kernel-64kb-optionalUpgrade kernel-64kbUpgrade kernel-sourceUpgrade dtb-alteraUpgrade kernel-azure-optionalUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmallUpgrade ocfs2-kmp-azureUpgrade kernel-64kb-extraUpgrade kernel-defaultUpgrade kernel-rt-vdsoUpgrade dtb-hisiliconUpgrade dtb-rockchipUpgrade kernel-rt-extraUpgrade kselftests-kmp-azureUpgrade dtb-xilinxUpgrade ocfs2-kmp-defaultUpgrade kernel-debug-develUpgrade dtb-nvidiaUpgrade dtb-renesasUpgrade dlm-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-docsUpgrade dtb-armUpgrade kernel-debug-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-rt_debugUpgrade dtb-caviumUpgrade kernel-obs-buildUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-source-rtUpgrade dtb-amdUpgrade kernel-develUpgrade kernel-debugUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-default-baseUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-preempt-develUpgrade dtb-sprdUpgrade cluster-md-kmp-rtUpgrade dtb-marvellUpgrade dtb-appleUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-azure-baseUpgrade kernel-azureUpgrade kernel-default-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-socionextUpgrade dtb-allwinner | Jun 12, 2024 | May 19, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-genericUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-gkeUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-intelUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-oem-24.04aUpgrade linux-image-ibmUpgrade linux-image-awsUpgrade linux-image-oracle-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-ibm-classicUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-kvm | Jul 12, 2024 | May 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | May 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub