CVE-2024-27038 json
clk: Fix clk_core_get NULL dereference
published 2024-05-01 2 y ago modified 2026-10-15 25 d ago also EUVD-2024-24300
- cvss
- 5.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: Fix clk_core_get NULL dereference
It is possible for clk_core_get to dereference a NULL in the following sequence:
clk_core_get() of_clk_get_hw_from_clkspec() __of_clk_get_hw_from_provider() __clk_get_hw()
__clk_get_hw() can return NULL which is dereferenced by clk_core_get() at hw->core.
Prior to commit dde4eff47c82 ("clk: Look for parents with clkdev based clk_lookups") the check IS_ERR_OR_NULL() was performed which would have caught the NULL.
Reading the description of this function it talks about returning NULL but that cannot be so at the moment.
Update the function to check for hw before dereferencing it and return NULL if hw is NULL.
Patch / fix
- Linux Linux 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
- Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1.1
- linux Debian 12 6.1.85-1
- linux Debian 14, Debian 13 6.7.12-1
debian advisories DEBIAN-CVE-2024-27038
- linux Ubuntu 20.04 LTS 5.4.0-189.209
- linux Ubuntu 22.04 LTS 5.15.0-112.122
- linux Ubuntu 24.04 LTS 6.8.0-35.35
- linux-aws Ubuntu 20.04 LTS 5.4.0-1128.138
- linux-aws Ubuntu 22.04 LTS 5.15.0-1063.69
- linux-aws Ubuntu 24.04 LTS 6.8.0-1009.9
- linux-gcp Ubuntu 20.04 LTS 5.4.0-1132.141
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1062.70
ubuntu advisories UBUNTU-CVE-2024-27038
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel RHEL 9 5.14.0-503.11.1.el9_5
- rv RHEL 9 5.14.0-503.11.1.el9_5
- perf RHEL 9 5.14.0-503.11.1.el9_5
- rtla RHEL 9 5.14.0-503.11.1.el9_5
- bpftool RHEL 9 7.4.0-503.11.1.el9_5
- libperf RHEL 9 5.14.0-503.11.1.el9_5
- kernel-rt RHEL 9 5.14.0-503.11.1.el9_5
- kernel-64k RHEL 9 5.14.0-503.11.1.el9_5
red hat advisories RHSA-2024:9315
- kernel-rt Linux Micro 6.0 6.4.0-9.1
- kernel-source-rt Linux Micro 6.0 6.4.0-9.1
- kernel-source Linux Micro 6.0 6.4.0-18.1
- kernel-default Linux Micro 6.0 6.4.0-18.1
- kernel-kvmsmall Linux Micro 6.0 6.4.0-18.1
- kernel-default-base Linux Micro 6.0 6.4.0-17.1.1.51
- kernel-rt SLE Micro 5.5, Real Time Module 15 SP5, openSUSE Leap 15.5 5.14.21-150500.13.52.1
- kernel-syms-rt Real Time Module 15 SP5, openSUSE Leap 15.5 5.14.21-150500.13.52.1
suse advisories SUSE-SU-2025:20028-1SUSE-SU-2025:20008-1SUSE-SU-2024:1663-1SUSE-SU-2024:1659-1SUSE-SU-2024:1644-1
- hyperv-daemons Azure Linux 3.0 6.6.29.1-1
azure linux advisories AZL-40337
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- git.kernel.org/stable/c/d7ae7d1265686b55832a445b1db8cdd69738ac07 commit
- git.kernel.org/stable/c/239174535dba11f7b83de0eaaa27909024f8c185 commit
- git.kernel.org/stable/c/0efb9ef6fb95384ba631d6819e66f10392aabfa2 commit
- git.kernel.org/stable/c/a8b2b26fdd011ebe36d68a9a321ca45801685959 commit
- git.kernel.org/stable/c/a5d9b1aa61b401867b9066d54086b3e4ee91f8ed commit
- git.kernel.org/stable/c/c554badcae9c45b737a22d23454170c6020b90e6 commit
- git.kernel.org/stable/c/6f073b24a9e2becd25ac4505a9780a87e621bb51 commit
- git.kernel.org/stable/c/e97fe4901e0f59a0bfd524578fe3768f8ca42428 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-27038 updated cvss 5.5
kernel: clk: Fix clk_core_get NULL dereference
-
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 moreaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 moreaffected: no fix available
-
Red Hat CodeReady Linux Builder (v. 9) libperf 5.14.0-503.11.1.el9_5, kernel-debuginfo-common-s390x 5.14.0-503.11.1.el9_5, kernel-debuginfo-common-x86_64 5.14.0-503.11.1.el9_5, kernel-debuginfo-common-aarch64 5.14.0-503.11.1.el9_5, kernel-debuginfo-common-ppc64le 5.14.0-503.11.1.el9_5 Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-503.11.1.el9_5, perf 5.14.0-503.11.1.el9_5, rtla 5.14.0-503.11.1.el9_5, kernel-devel-matched 5.14.0-503.11.1.el9_5, kernel-64k-devel-matched 5.14.0-503.11.1.el9_5, kernel-debug-devel-matched 5.14.0-503.11.1.el9_5, +6 more Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.4.0-503.11.1.el9_5, kernel 5.14.0-503.11.1.el9_5, kernel-64k 5.14.0-503.11.1.el9_5, kernel-core 5.14.0-503.11.1.el9_5, kernel-tools 5.14.0-503.11.1.el9_5, python3-perf 5.14.0-503.11.1.el9_5, +29 more Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-503.11.1.el9_5, kernel-rt-core 5.14.0-503.11.1.el9_5, kernel-rt-modules 5.14.0-503.11.1.el9_5, kernel-rt-debug-core 5.14.0-503.11.1.el9_5, kernel-rt-modules-core 5.14.0-503.11.1.el9_5, kernel-rt-debug-modules 5.14.0-503.11.1.el9_5, +4 more Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-503.11.1.el9_5, kernel-rt-kvm 5.14.0-503.11.1.el9_5, kernel-rt-core 5.14.0-503.11.1.el9_5, kernel-rt-modules 5.14.0-503.11.1.el9_5, kernel-rt-debug-kvm 5.14.0-503.11.1.el9_5, kernel-rt-debug-core 5.14.0-503.11.1.el9_5, +6 morefixed: vendor fix RHSA-2024:9315
-
Red Hat CodeReady Linux Builder (v. 9) kernel-cross-headers 5.14.0-503.11.1.el9_5 Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux AppStream (v. 9) kernel-headers 5.14.0-503.11.1.el9_5not affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-24-102-01 updated cvss 7.5
Siemens SIMATIC S7-1500 TM MFP
-
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystemaffected: mitigation, no fix available
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Linux Linux
- Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Classification
- Weakness
-
- CWE-476 NULL Pointer Dereference
- Technology feeds
References
-
git.kernel.org
/stable/c/d7ae7d1265686b55832a445b1db8cdd69738ac07
patch
-
git.kernel.org
/stable/c/239174535dba11f7b83de0eaaa27909024f8c185
patch
-
git.kernel.org
/stable/c/0efb9ef6fb95384ba631d6819e66f10392aabfa2
patch
-
git.kernel.org
/stable/c/a8b2b26fdd011ebe36d68a9a321ca45801685959
patch
-
git.kernel.org
/stable/c/a5d9b1aa61b401867b9066d54086b3e4ee91f8ed
patch
-
git.kernel.org
/stable/c/c554badcae9c45b737a22d23454170c6020b90e6
patch
-
git.kernel.org
/stable/c/6f073b24a9e2becd25ac4505a9780a87e621bb51
patch
-
git.kernel.org
/stable/c/e97fe4901e0f59a0bfd524578fe3768f8ca42428
patch
-
lists.debian.org
/debian-lts-announce/2024/06/msg00017.html
mailing-list, third-party-advisory
- cert-portal.siemens.com /productcert/html/ssa-265688.html
Sources
- CVE List CVE-2024-27038
- NVD CVE-2024-27038
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.