CVE-2024-53205

What it actually does

NULL pointer dereference in rtk_usb2phy_probe when devm_kzalloc returns NULL without validation, leading to memory corruption on failure path.

Why it matters to the business

Potential system crashes or instability during USB hardware initialization on affected Linux systems, interrupting device functionality and requiring reboots.

How an attack unfolds

An attacker triggers the probe function under memory pressure so the unchecked allocation failure causes an immediate kernel dereference and crash; no public exploitation observed.

How to fix it

Upgrade flashplugin-nonfree on Ubuntu 14.04 LTS to version 11.2.202.637ubuntu0.14.04.1 or later; apply the upstream kernel fix for the Realtek USB PHY driver.

How to confirm the fix worked

Confirm the installed flashplugin-nonfree package version matches or exceeds the fixed release; verify kernel source no longer contains the unchecked kzalloc call in rtk_usb2phy_probe.

Typical attack path

1. Create low-memory conditions on the target system
2. Trigger USB2 PHY device probe via hardware insertion or driver load
3. Force devm_kzalloc to return NULL
4. Execute the unchecked pointer dereference to crash the kernel

How to detect it

Review kernel logs for NULL dereference oops in the Realtek USB2 PHY probe path; no specific post-exploitation artifacts are known.

What your security team should do

• Apply the listed package update immediately on all Ubuntu 14.04 systems using the affected driver
• Monitor for kernel oops or panic logs referencing the Realtek USB PHY probe function
• Test USB device enumeration after patching to ensure stability