CVE-2024-58058 – This CVE describes a null pointer dereference v... (How to Fix)

Q: What is the severity of CVE-2024-58058?

CVE-2024-58058 has a CVSS score of 5.5 (MEDIUM). This CVE describes a null pointer dereference vulnerability in the Linux kernel's UBIFS filesystem implementation. When slab cache is cleared, it can cause the UBIFS tnc tree dumping function to access a null pointer, potentially causing a kernel panic. This affects systems using UBIFS filesystem with specific kernel versions.

📋 TL;DR

This CVE describes a null pointer dereference vulnerability in the Linux kernel's UBIFS filesystem implementation. When slab cache is cleared, it can cause the UBIFS tnc tree dumping function to access a null pointer, potentially causing a kernel panic. This affects systems using UBIFS filesystem with specific kernel versions.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific kernel versions containing the vulnerable UBIFS code (exact versions would need to be determined from git commits)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems using UBIFS (Unsorted Block Image File System), typically used in embedded systems and flash storage devices.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data corruption or loss if filesystem operations are interrupted.

🟠

Likely Case

System crash or kernel panic when specific UBIFS operations are performed after slab cache clearing, resulting in denial of service.

🟢

If Mitigated

No impact if the vulnerable code path is not triggered or if systems don't use UBIFS filesystem.

🌐 Internet-Facing: LOW - This is a local filesystem vulnerability requiring local access to trigger.

🏢 Internal Only: MEDIUM - Could be exploited by local users or processes to cause denial of service on affected systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger specific UBIFS operations. The vulnerability is in a specific code path that may not be frequently executed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in kernel git commits referenced in CVE

Vendor Advisory: https://git.kernel.org/stable/c/1787cd67bb94b106555ffe64f887f6aa24b47010

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check with your distribution vendor for specific kernel updates. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable UBIFS if not needed

linux

If UBIFS filesystem is not required, disable it in kernel configuration or avoid using it.

🧯 If You Can't Patch

Restrict local user access to systems using UBIFS
Monitor for kernel panic events and investigate UBIFS-related crashes

🔍 How to Verify

Check if Vulnerable:

Check kernel version and UBIFS usage: 'uname -r' and check if UBIFS is mounted or in use

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated beyond vulnerable versions and test UBIFS operations

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
UBIFS error messages in dmesg
System crash logs

Network Indicators:

None - local vulnerability

SIEM Query:

Search for 'kernel panic' or 'UBIFS' in system logs with timestamps matching system crashes

📊 Metadata

CVE ID: CVE-2024-58058

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.05% exploit probability (16.4th percentile)

Published: March 6, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-58058, you might also want to check these: