CVE-2024-27051 – This CVE addresses a NULL pointer dereference v... (How to Fix)

Q: What is the severity of CVE-2024-27051?

CVE-2024-27051 has a CVSS score of 5.5 (MEDIUM). This CVE addresses a NULL pointer dereference vulnerability in the Linux kernel's cpufreq driver for Broadcom STB AVS processors. If exploited, it could cause a kernel panic leading to denial of service. Systems using affected Broadcom STB hardware with vulnerable kernel versions are impacted.

📋 TL;DR

This CVE addresses a NULL pointer dereference vulnerability in the Linux kernel's cpufreq driver for Broadcom STB AVS processors. If exploited, it could cause a kernel panic leading to denial of service. Systems using affected Broadcom STB hardware with vulnerable kernel versions are impacted.

💻 Affected Systems

Products:

Linux kernel with brcmstb-avs-cpufreq driver

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Broadcom STB AVS processors where the brcmstb-avs-cpufreq driver is loaded and used.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially requiring physical reboot of affected devices.

🟠

Likely Case

System instability or crash when cpufreq operations are performed on affected hardware, resulting in temporary service disruption.

🟢

If Mitigated

Minor system instability that may be automatically recovered by kernel protections if available.

🌐 Internet-Facing: LOW - Requires local access or ability to trigger cpufreq operations on affected hardware.

🏢 Internal Only: MEDIUM - Local users or processes could trigger the vulnerability causing system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to trigger cpufreq operations on affected hardware, typically through local access or specific system calls.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits (74b84d0d7118, 9127599c075c, b25b64a241d7, d951cf510fb0, e6e3e51ffba0)

Vendor Advisory: https://git.kernel.org/stable/c/74b84d0d71180330efe67c82f973a87f828323e5

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load patched kernel. 3. Verify driver functionality post-update.

🔧 Temporary Workarounds

Disable affected cpufreq driver

linux

Prevent loading of brcmstb-avs-cpufreq driver to avoid vulnerability

echo 'blacklist brcmstb-avs-cpufreq' >> /etc/modprobe.d/blacklist.conf
update-initramfs -u
reboot

🧯 If You Can't Patch

Restrict local user access to systems with affected hardware
Monitor system logs for kernel panic events related to cpufreq operations

🔍 How to Verify

Check if Vulnerable:

Check if brcmstb-avs-cpufreq driver is loaded: lsmod | grep brcmstb-avs-cpufreq

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched versions from git commits, or verify driver loads without errors in dmesg

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
NULL pointer dereference errors related to cpufreq

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "kernel panic") AND "cpufreq"

📊 Metadata

CVE ID: CVE-2024-27051

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: May 1, 2024

Last Updated: December 23, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-27051, you might also want to check these: