Cloudanix VulnDB

CVE-2024-49941

None

CVSS

—

EPSS

0.2%

Published

Oct 21, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in the Linux kernel's handling of certain hardware labels could cause the system to crash when specific device information is read.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in gpiod_get_label() when srcu_dereference_check() returns NULL, allowing label->str access without validation and producing (efault) output in sysfs GPIO dumps.

Why it matters to the business

Kernel instability or crashes on systems exposing GPIO interfaces, increasing downtime and operational risk for embedded, server, and IoT deployments running affected kernels; urgency is low given absence from KEV and stable low EPSS.

How an attack unfolds

An attacker with local access to GPIO sysfs triggers the dereference path in gpiod_get_label() during label retrieval or dump operations, potentially causing an oops or panic; listed threat actors have targeted similar Linux kernel memory issues in espionage and financially motivated campaigns.

How to fix it

Upgrade the Linux kernel to version 6.11.3 or later (or the equivalent stable commit 9ee4b907d7a5d7a53b4ff7727c371ff3d44ccbbb); rebuild and reboot with the patched kernel; for Rocky Linux 8 apply glibc update 2.28-151.el8 if applicable to the distribution kernel package.

How to confirm the fix worked

Confirm the running kernel version is at or above the fixed release, then exercise GPIO sysfs label retrieval under load and verify no (efault) strings or NULL dereference oops appear in dmesg.

Typical attack path

  1. Gain local shell or process execution on a Linux system with GPIO sysfs exposed
  2. Interact with GPIO character device or sysfs entries to invoke gpiod_get_label()
  3. Trigger the NULL label path via concurrent unregistration or specific device state
  4. Observe kernel oops, (efault) output, or system instability

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or NULL dereference traces referencing gpiod_get_label or GPIO sysfs; correlate with processes accessing /sys/class/gpio during the timeframe of any observed instability.

What your security team should do

  • Prioritize kernel updates on all systems exposing GPIO interfaces within the next maintenance window
  • Monitor EPSS and KEV status for any change in exploit maturity
  • Restrict unprivileged access to GPIO sysfs where operationally feasible
  • Include kernel version checks in vulnerability scanning and asset inventory

The record

In the Linux kernel, the following vulnerability has been resolved: gpiolib: Fix potential NULL pointer dereference in gpiod_get_label() In `gpiod_get_label()`, it is possible that `srcu_dereference_check()` may return a NULL pointer, leading to a scenario where `label->str` is accessed without verifying if `label` itself is NULL. This patch adds a proper NULL check for `label` before accessing `label->str`. The check for `label->str != NULL` is removed because `label->str` can never be NULL if `label` is not NULL. This fixes the issue where the label name was being printed as `(efault)` when dumping the sysfs GPIO file when `label == NULL`.

Affected packages

Ecosystem Package Introduced Fixed
Debian:13 linux 0 No fix
Linux Kernel 6.9.0 6.11.3
Ubuntu:24.10 linux 0 6.11.0-18.18
Ubuntu:24.10 linux-aws 0 6.11.0-1009.10
Ubuntu:24.10 linux-azure 0 6.11.0-1009.9
Ubuntu:24.10 linux-gcp 0 6.11.0-1009.9
Ubuntu:24.10 linux-lowlatency 0 6.11.0-1010.11
Ubuntu:24.10 linux-oracle 0 6.11.0-1011.12
Ubuntu:24.10 linux-raspi 0 6.11.0-1008.8
Ubuntu:24.10 linux-realtime 0 6.11.0-1005.5
openSUSE:Tumbleweed kernel-source 0 6.11.8-1.1
openSUSE:Tumbleweed kernel-source-longterm 0 6.12.11-1.1

Related vulnerabilities