vulnerability
Ubuntu: (Multiple Advisories) (CVE-2024-50198): Linux kernel vulnerabilities
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
5 | (AV:L/AC:L/Au:S/C:N/I:N/A:C) | Nov 8, 2024 | Feb 20, 2025 | May 27, 2025 |
Description
In the Linux kernel, the following vulnerability has been resolved:
iio: light: veml6030: fix IIO device retrieval from embedded device
The dev pointer that is received as an argument in the
in_illuminance_period_available_show function references the device
embedded in the IIO device, not in the i2c client.
dev_to_iio_dev() must be used to accessthe right data. The current
implementation leads to a segmentation fault on every attempt to read
the attribute because indio_dev gets a NULL assignment.
This bug has been present since the first appearance of the driver,
apparently since the last version (V6) before getting applied. A
constant attribute was used until then, and the last modifications might
have not been tested again.
Solution(s)
References
- CVE-2024-50198
- https://attackerkb.com/topics/CVE-2024-50198
- UBUNTU-USN-7276-1
- UBUNTU-USN-7277-1
- UBUNTU-USN-7288-1
- UBUNTU-USN-7288-2
- UBUNTU-USN-7289-1
- UBUNTU-USN-7289-2
- UBUNTU-USN-7289-3
- UBUNTU-USN-7289-4
- UBUNTU-USN-7291-1
- UBUNTU-USN-7305-1
- UBUNTU-USN-7308-1
- UBUNTU-USN-7310-1
- UBUNTU-USN-7331-1
- UBUNTU-USN-7383-1
- UBUNTU-USN-7383-2
- UBUNTU-USN-7384-1
- UBUNTU-USN-7384-2
- UBUNTU-USN-7385-1
- UBUNTU-USN-7386-1
- UBUNTU-USN-7388-1
- UBUNTU-USN-7389-1
- UBUNTU-USN-7390-1
- UBUNTU-USN-7403-1
- UBUNTU-USN-7451-1
- UBUNTU-USN-7458-1
- UBUNTU-USN-7468-1
- UBUNTU-USN-7523-1
- UBUNTU-USN-7524-1

Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.