CVE-2024-56612

Summary

CVE-2024-56612: A vulnerability was discovered in the Linux kernel's mm/gup module. The issue arises from an assumption in unpin_user_pages() that it handles NULL pages in the pages array. However, this is not the case, leading to a kernel NULL pointer dereference. This vulnerability was uncovered on an x86 systemrunning Linux 6.12 with certain configuration settings and running the 'gup_longterm' self-test. The crash occurs during the unpin_user_pages() function call, causing a kernel panic. To address this issue, NULL pages should be skipped in unpin_user_pages(), as already implemented in unpin_folios().

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.