CVE-2024-27071

What it actually does

Missing NULL check on optional "im" pins in hx8357_probe() allows potential NULL pointer dereference during driver initialization in the Linux kernel backlight subsystem.

Why it matters to the business

May cause kernel crashes or system instability on Linux devices using the hx8357 backlight controller, resulting in unexpected downtime or denial of service.

How an attack unfolds

An attacker with local access loads or triggers the hx8357 driver on a system where the optional pins are absent, causing the probe function to dereference a NULL pointer and panic the kernel.

How to fix it

Upgrade the Linux kernel to version 6.8.2 or later, or apply commit 67e578c8ff2d7df03bf8ca9a7f5436b1796f6ad1 in the stable tree.

How to confirm the fix worked

Confirm kernel version is 6.8.2 or newer; inspect hx8357_probe() source to verify the added NULL check for optional pins.

Typical attack path

1. Gain local access to target Linux system
2. Ensure or configure environment lacking optional "im" pins for hx8357
3. Trigger driver probe or module load
4. Induce NULL pointer dereference leading to kernel panic

How to detect it

Review kernel logs and dmesg output for NULL pointer dereference or oops entries referencing hx8357_probe or the backlight driver during device initialization.

• hx8357_probe
• NULL pointer dereference
• backlight: hx8357

What your security team should do

• Prioritize kernel upgrade to 6.8.2 on all affected systems
• Test driver initialization in lab environments mirroring production hardware
• Monitor kernel logs for hx8357-related oops messages