CVE-2024-38547
📋 TL;DR
A null-pointer dereference vulnerability in the Linux kernel's atomisp media subsystem allows local attackers to cause a kernel panic (denial of service) or potentially execute arbitrary code. This affects systems using Intel Atom image signal processors with the affected kernel versions. The vulnerability requires local access to exploit.
💻 Affected Systems
- Linux kernel with atomisp media subsystem enabled
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level code execution, potentially leading to full system compromise.
Likely Case
Kernel panic causing system crash and denial of service.
If Mitigated
Limited to denial of service if kernel protections like KASLR and SMAP are enabled.
🎯 Exploit Status
Requires local access and knowledge of triggering the specific media subsystem functions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing commits 3b621e9e9e148c0928ab109ac3d4b81487469acb or later
Vendor Advisory: https://git.kernel.org/stable/c/3b621e9e9e148c0928ab109ac3d4b81487469acb
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable atomisp module
linuxPrevent loading of vulnerable kernel module
echo 'blacklist atomisp' >> /etc/modprobe.d/blacklist.conf
rmmod atomisp
🧯 If You Can't Patch
- Restrict local user access to systems with vulnerable configuration
- Implement strict privilege separation and limit users who can access media subsystem functions
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if atomisp module is loaded: 'uname -r' and 'lsmod | grep atomisp'Check Version:
uname -rVerify Fix Applied:
Verify kernel version is patched and atomisp module loads without crashes during media operations📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- NULL pointer dereference errors in dmesg
- System crash/reboot events
Network Indicators:
- None - local exploitation only
SIEM Query:
Search for kernel panic events or NULL pointer dereference in system logs🔗 References
- https://git.kernel.org/stable/c/3b621e9e9e148c0928ab109ac3d4b81487469acb
- https://git.kernel.org/stable/c/4b68b861b514a5c09220d622ac3784c0ebac6c80
- https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654
- https://git.kernel.org/stable/c/6482c433863b257b0b9b687c28ce80b89d5f89f0
- https://git.kernel.org/stable/c/69b27ff82f87379afeaaea4b2f339032fdd8486e
- https://git.kernel.org/stable/c/82c2c85aead3ea3cbceef4be077cf459c5df2272
- https://git.kernel.org/stable/c/a1ab99dcc8604afe7e3bccb01b10da03bdd7ea35
- https://git.kernel.org/stable/c/cc20c87b04db86c8e3e810bcdca686b406206069
- https://git.kernel.org/stable/c/3b621e9e9e148c0928ab109ac3d4b81487469acb
- https://git.kernel.org/stable/c/4b68b861b514a5c09220d622ac3784c0ebac6c80
- https://git.kernel.org/stable/c/6482c433863b257b0b9b687c28ce80b89d5f89f0
- https://git.kernel.org/stable/c/69b27ff82f87379afeaaea4b2f339032fdd8486e
- https://git.kernel.org/stable/c/82c2c85aead3ea3cbceef4be077cf459c5df2272
- https://git.kernel.org/stable/c/a1ab99dcc8604afe7e3bccb01b10da03bdd7ea35
- https://git.kernel.org/stable/c/cc20c87b04db86c8e3e810bcdca686b406206069
