CVE-2024-41077 – A vulnerability in the Linux kernel's null

Q: What is the severity of CVE-2024-41077?

CVE-2024-41077 has a CVSS score of 5.5 (MEDIUM). A vulnerability in the Linux kernel's null_blk driver allows improper validation of block size parameters. Attackers could trigger a null pointer dereference leading to kernel panic (system crash) when loading the driver with invalid block sizes. This affects systems using the null_blk driver for testing or development purposes.

📋 TL;DR

A vulnerability in the Linux kernel's null_blk driver allows improper validation of block size parameters. Attackers could trigger a null pointer dereference leading to kernel panic (system crash) when loading the driver with invalid block sizes. This affects systems using the null_blk driver for testing or development purposes.

💻 Affected Systems

Products:

Linux kernel with null_blk driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when null_blk driver is loaded with invalid block size parameter (bs=1536 or other invalid values). The driver is typically used for testing/development, not in default production configurations.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to complete system crash and denial of service, potentially causing data loss or service disruption.

🟠

Likely Case

System crash when null_blk driver is loaded with invalid parameters, affecting testing/development environments using this driver.

🟢

If Mitigated

Minimal impact since null_blk is typically used in controlled testing environments, not production systems.

🌐 Internet-Facing: LOW - null_blk driver is not typically exposed to internet-facing interfaces.

🏢 Internal Only: MEDIUM - Internal users or processes could trigger the vulnerability if they have access to load kernel modules with invalid parameters.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: LOW - Requires ability to load kernel modules with specific invalid parameters.

Exploitation requires kernel module loading privileges (typically root or CAP_SYS_MODULE). No public exploit code has been identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 08f03186b96e25e3154916a2e70732557c770ea7, 2772ed2fc075eef7df3789906fc9dae01e4e132e, 9625afe1dd4a158a14bb50f81af9e2dac634c0b1, 9b873bdaae64bddade9d8c6df23c8a31948d47d0, c462ecd659b5fce731f1d592285832fd6ad54053

Vendor Advisory: https://git.kernel.org/stable/c/08f03186b96e25e3154916a2e70732557c770ea7

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check your distribution's security advisories for specific patched kernel versions. 3. Reboot system to load patched kernel.

🔧 Temporary Workarounds

Disable null_blk module loading

linux

Prevent loading of the vulnerable null_blk driver module

echo 'install null_blk /bin/false' >> /etc/modprobe.d/disable-null_blk.conf
rmmod null_blk 2>/dev/null || true

Restrict kernel module loading

linux

Limit who can load kernel modules to prevent unauthorized use

sysctl -w kernel.modules_disabled=1
echo 'kernel.modules_disabled=1' >> /etc/sysctl.conf

🧯 If You Can't Patch

Avoid using null_blk driver with invalid block size parameters (bs should be power of 2 between 512 and PAGE_SIZE)
Implement strict access controls to prevent unauthorized users from loading kernel modules

🔍 How to Verify

Check if Vulnerable:

Check if null_blk module is loaded and kernel version is vulnerable: lsmod | grep null_blk && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits or check if null_blk accepts invalid block sizes without crashing

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
System crash/reboot events
Failed module loading attempts for null_blk

Network Indicators:

None - this is a local kernel vulnerability

SIEM Query:

source="kern.log" AND "kernel panic" OR "null pointer dereference" OR "null_blk"

📊 Metadata

CVE ID: CVE-2024-41077

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: July 29, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-41077, you might also want to check these: