CVE-2024-58021
📋 TL;DR
A NULL pointer dereference vulnerability exists in the Linux kernel's winwing HID driver. If devm_kasprintf() fails and returns NULL in winwing_init_led(), the kernel will crash when trying to dereference this pointer. This affects Linux systems using the winwing HID driver for WinWing gaming peripherals.
💻 Affected Systems
- Linux kernel with winwing HID driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.
Likely Case
Local denial of service when the winwing driver fails to initialize properly, requiring system reboot.
If Mitigated
Minimal impact if systems don't use WinWing peripherals or have the driver disabled.
🎯 Exploit Status
Exploitation requires local access and ability to trigger driver initialization failure, typically through hardware manipulation or driver loading.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing commits 4001f6f79183b8868d80dd2036dfb4ea3d325e8f, 45ab5166a82d038c898985b0ad43ead69c1f9573, or b99dbdee8a89c44d03ae9830ab19f31e124a3f32
Vendor Advisory: https://git.kernel.org/stable/c/4001f6f79183b8868d80dd2036dfb4ea3d325e8f
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.
🔧 Temporary Workarounds
Disable winwing driver
linuxPrevent loading of the vulnerable winwing HID driver
echo 'blacklist winwing' >> /etc/modprobe.d/blacklist-winwing.conf
update-initramfs -u
reboot
Avoid WinWing peripherals
allDo not connect WinWing gaming devices to vulnerable systems
🧯 If You Can't Patch
- Disconnect any WinWing gaming peripherals from affected systems
- Ensure only trusted users have physical access to systems where WinWing devices might be connected
🔍 How to Verify
Check if Vulnerable:
Check if winwing module is loaded: lsmod | grep winwing. Check kernel version against distribution's security advisories.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes fix commits or is newer than vulnerable versions. Check dmesg for winwing driver errors after connecting device.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages in /var/log/kern.log or dmesg
- NULL pointer dereference errors related to winwing driver
SIEM Query:
source="kernel" AND ("winwing" OR "NULL pointer dereference")