CVE-2024-42100 – This CVE describes a NULL pointer dereference v... (How to Fix)

Q: What is the severity of CVE-2024-42100?

CVE-2024-42100 has a CVSS score of 5.5 (MEDIUM). This CVE describes a NULL pointer dereference vulnerability in the Linux kernel's sunxi-ng clock controller driver. The flaw occurs when the driver incorrectly assumes all hardware clock entries are contained in a common structure, leading to potential kernel crashes or denial of service. Systems using affected Linux kernel versions with Allwinner (sunxi) hardware are vulnerable.

📋 TL;DR

This CVE describes a NULL pointer dereference vulnerability in the Linux kernel's sunxi-ng clock controller driver. The flaw occurs when the driver incorrectly assumes all hardware clock entries are contained in a common structure, leading to potential kernel crashes or denial of service. Systems using affected Linux kernel versions with Allwinner (sunxi) hardware are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected kernel versions not explicitly stated in CVE description; check git commits for exact versions.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Allwinner (sunxi) SoC hardware where the sunxi-ng clock controller driver is loaded and used.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially requiring physical access to restart the system.

🟠

Likely Case

System instability or crash when specific clock operations are performed on affected hardware, resulting in temporary denial of service.

🟢

If Mitigated

No impact if the vulnerable code path isn't triggered or if the system doesn't use affected Allwinner hardware.

🌐 Internet-Facing: LOW - This is a local kernel driver vulnerability requiring access to the clock controller subsystem.

🏢 Internal Only: MEDIUM - Local users or processes could potentially trigger the vulnerability, causing system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering the specific code path in the sunxi-ng driver, likely requiring local access or specific hardware operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check git commits: 14c78d69dbca6a28af14095f639ec4318ec07fdc, 7a0e2738cb6da5a55c9908dff333600aeb263e07, ea977d742507e534d9fe4f4d74256f6b7f589338

Vendor Advisory: https://git.kernel.org/stable/c/14c78d69dbca6a28af14095f639ec4318ec07fdc

Restart Required: Yes

Instructions:

1. Update Linux kernel to a version containing the fix commits. 2. For embedded systems: Update kernel source, rebuild, and flash. 3. For distributions: Apply security updates from your vendor. 4. Reboot system after patching.

🔧 Temporary Workarounds

Disable sunxi-ng driver

linux

Prevent loading of the vulnerable sunxi-ng clock controller driver if not required

echo 'blacklist sunxi-ng' >> /etc/modprobe.d/blacklist-sunxi-ng.conf
update-initramfs -u
reboot

🧯 If You Can't Patch

Restrict access to users who could trigger clock operations on affected hardware
Implement monitoring for kernel panics and system instability

🔍 How to Verify

Check if Vulnerable:

Check if system uses Allwinner hardware and vulnerable kernel version: 'uname -r' and check dmesg for sunxi-ng driver loading

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits: 'uname -r' and check git commit history for your kernel build

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
NULL pointer dereference errors mentioning sunxi-ng

Network Indicators:

None - this is a local kernel vulnerability

SIEM Query:

source="kernel" AND ("sunxi-ng" OR "NULL pointer dereference")

📊 Metadata

CVE ID: CVE-2024-42100

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: July 30, 2024

Last Updated: September 26, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-42100, you might also want to check these: