Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ CVE-2024-47688 — kernel

🟡 CVSS 5.5 — Medium ✅ No Known Exploit NVD
5.5
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

driver core: Fix a potential null-ptr-deref in module_add_driver()

In the Linux kernel, the following vulnerability has been resolved:

driver core: Fix a potential null-ptr-deref in module_add_driver()

Inject fault while probing of-fpga-region, if kasprintf() fails in

module_add_driver(), the second sysfs_remove_link() in exit path will cause

null-ptr-deref as below because kernfs_name_hash() will call strlen() with

NULL driver_name.

Fix it by releasing resources based on the exit path sequence.

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

Mem abort info:

ESR = 0x0000000096000005

EC = 0x25: DABT (current EL), IL = 32 bits

SET = 0, FnV = 0

EA = 0, S1PTW = 0

FSC = 0x05: level 1 translation fault

Data abort info:

ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000

CM = 0, WnR = 0, TnD = 0, TagAccess = 0

GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0

[dfffffc000000000] address between user and kernel address ranges

Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP

Dumping ftrace buffer:

(ftrace buffer empty)

Modules linked in: of_fpga_region(+) fpga_region fpga_bridge cfg80211 rfkill 8021q garp mrp stp llc ipv6 [last unloaded: of_fpga_region]

CPU: 2 UID: 0 PID: 2036 Comm: modprobe Not tainted 6.11.0-rc2-g6a0e38264012 #295

Hardware name: linux,dummy-virt (DT)

pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : strlen+0x24/0xb0

lr : kernfs_name_hash+0x1c/0xc4

sp : ffffffc081f97380

x29: ffffffc081f97380 x28: ffffffc081f97b90 x27: ffffff80c821c2a0

x26: ffffffedac0be418 x25: 0000000000000000 x24: ffffff80c09d2000

x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000

x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000001840

x17: 0000000000000000 x16: 0000000000000000 x15: 1ffffff8103f2e42

x14: 00000000f1f1f1f1 x13: 0000000000000004 x12: ffffffb01812d61d

x11: 1ffffff01812d61c x10: ffffffb01812d61c x9 : dfffffc000000000

x8 : 0000004fe7ed29e4 x7 : ffffff80c096b0e7 x6 : 0000000000000001

x5 : ffffff80c096b0e0 x4 : 1ffffffdb990efa2 x3 : 0000000000000000

x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000000

Call trace:

strlen+0x24/0xb0

kernfs_name_hash+0x1c/0xc4

kernfs_find_ns+0x118/0x2e8

kernfs_remove_by_name_ns+0x80/0x100

sysfs_remove_link+0x74/0xa8

module_add_driver+0x278/0x394

bus_add_driver+0x1f0/0x43c

driver_register+0xf4/0x3c0

__platform_driver_register+0x60/0x88

of_fpga_region_init+0x20/0x1000 [of_fpga_region]

do_one_initcall+0x110/0x788

do_init_module+0x1dc/0x5c8

load_module+0x3c38/0x4cac

init_module_from_file+0xd4/0x128

idempotent_init_module+0x2cc/0x528

__arm64_sys_finit_module+0xac/0x100

invoke_syscall+0x6c/0x258

el0_svc_common.constprop.0+0x160/0x22c

do_el0_svc+0x44/0x5c

el0_svc+0x48/0xb8

el0t_64_sync_handler+0x13c/0x158

el0t_64_sync+0x190/0x194

Code: f2fbffe1 a90157f4 12000802 aa0003f5 (38e16861)

---[ end trace 0000000000000000 ]---

Kernel panic - not syncing: Oops: Fatal exception

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability high.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

  • Attack vector: Local — a local account, shell or session on the host is needed.
  • Attack complexity: Low — the attack works reliably, with no preparation.
  • Privileges required: Low — an ordinary user account is enough.
  • User interaction: None — nobody has to be tricked into anything.
  • Scope: Unchanged — the damage stays inside the vulnerable component.
  • Confidentiality impact: None.
  • Integrity impact: None.
  • Availability impact: High — total loss, or loss the attacker controls.

Affected software

CVE-2024-47688 is recorded against 2 packages.

  • kernel (from 6.10.0 up to 6.11.2)
  • linux-kernel (from 6.11 up to 6.11.2)

Timeline and source

Published on 21 October 2024 and last revised on 12 August 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.

References

git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
github.com (Advisory)
nvd.nist.gov (Advisory)
git.kernel.org (Package)

Other advisories for this package

kernel has other advisories on record. If you are patching this one, these are worth checking on the same host:

CVE-2024-47688 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity Medium
CVSS Score 5.5
CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE N/A
Public Exploit ✅ No
Source NVD
Published 2024-10-21
Updated 2026-08-20
Modified 2026-08-12

Affected Packages

Software From version Fixed in
kernel 6.10.0 6.11.2
linux-kernel 6.11 6.11.2

Similar Threats

Vulnerability Monitoring

Track new vulnerabilities in kernel

CVE-2024-47688 is rated CVSS 5.5 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesCVECVE 2024
✓