CVE-2024-42320

What it actually does

Unchecked ERR_PTR return from dasd_add_busid() allocation failure leads to NULL pointer dereference inside dasd_copy_pair_store().

Why it matters to the business

Kernel crashes or denial of service on s390 DASD systems, affecting 572 downstream dependents and requiring prompt remediation.

How an attack unfolds

An attacker triggers memory allocation failure during dasd_add_busid() and invokes dasd_copy_pair_store() so the unchecked error pointer is dereferenced, potentially by local unprivileged code; similar patterns have appeared in 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors and Linux kernel resource-handling flaws.

How to fix it

Apply upstream kernel fix that adds IS_ERR() checks; upgrade any listed packages such as certifi (PyPI) to fixed version 2022.12.07.

How to confirm the fix worked

Inspect dasd_copy_pair_store() for IS_ERR() guards on dasd_add_busid() results and run allocation-failure test cases.

Typical attack path

1. Obtain local access on vulnerable s390 Linux system
2. Force allocation failure path in dasd_add_busid()
3. Invoke dasd_copy_pair_store() without error validation
4. Trigger NULL pointer dereference resulting in panic or DoS

How to detect it

Search kernel logs and crash dumps for oops/panic messages referencing dasd_copy_pair_store or NULL dereference in s390 DASD paths; correlate with threat actor activity around Linux kernel resource vulnerabilities.

What your security team should do

• Patch kernel to include the error-check fix
• Prioritize systems with s390 DASD usage given ecosystem prevalence
• Audit dependent packages for any certifi (PyPI) instances still at pre-2022.12.07 versions