CVE-2024-27038

What it actually does

NULL pointer dereference in clk_core_get() when __clk_get_hw() returns NULL, causing kernel crash during clock provider lookup from device tree.

Why it matters to the business

Local users or processes can trigger kernel panics on affected Linux systems, leading to unplanned reboots, service outages, and loss of availability on servers and embedded devices running vulnerable kernels.

How an attack unfolds

An attacker with local access crafts or triggers a device tree clock lookup that reaches __of_clk_get_hw_from_provider() returning NULL; clk_core_get() then dereferences hw->core without a NULL check, crashing the kernel.

How to fix it

Upgrade affected packages to the listed fixed versions or later: linux 3.11.0-12.19 / 4.4.0-2.16 / 4.13.0-16.19 / 5.4.0-9.12 and equivalent updates for linux-aws, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oracle and related meta-packages.

How to confirm the fix worked

Verify running kernel version is equal to or newer than the fixed package versions for the distribution; confirm absence of the vulnerable clk_core_get NULL path via source inspection or kernel symbol checks.

Typical attack path

1. Obtain local code execution or shell on target system
2. Trigger clock device-tree lookup via driver probe or clk_get API
3. Force __clk_get_hw() path to return NULL
4. clk_core_get() dereferences NULL pointer causing oops/panic

How to detect it

Review kernel logs for oops/panic traces containing clk_core_get, of_clk_get_hw_from_clkspec, or __clk_get_hw; correlate with recent local process activity or driver probes.

What your security team should do

• Prioritize patching of internet-facing or multi-tenant systems within 30 days
• Apply kernel updates via distribution package manager and reboot
• Restrict untrusted local user access on systems that cannot be immediately updated
• Monitor for kernel oops reports referencing clk_core_get or of_clk_get_hw_from_clkspec