Log in Start free

Vulnerability · Published Nov 8, 2024 · Assigned by Linux

CVE-2024-50198iio: light: veml6030: fix IIO device retrieval from embedded device

Medium 5.5

In plain English

A medium-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 89.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6030: fix IIO device retrieval from embedded device The dev pointer that is received as an argument in the in_illuminance_period_available_show function references the device embedded in the IIO device, not in the i2c client. dev_to_iio_dev() must be used to accessthe right data. The current implementation leads to a segmentation fault on every attempt to read the attribute because indio_dev gets a NULL assignment. This bug has been present since the first appearance of the driver, apparently since the last version (V6) before getting applied. A constant attribute was used until then, and the last modifications might have not been tested again.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.115-1DEBIAN-CVE-2024-50198
Debian:13linux6.11.5-1DEBIAN-CVE-2024-50198
Debian:14linux6.11.5-1DEBIAN-CVE-2024-50198
Ubuntu:22.04:LTSlinux5.15.0-133.144UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux6.8.0-56.58UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-aws5.15.0-1078.85UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-aws6.8.0-1025.27UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1027.29~22.04.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-azure5.15.0-1081.90UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-azure6.8.0-1025.30UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-azure-6.116.11.0-1012.12~24.04.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1025.30~22.04.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1081.90.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-azure-nvidia6.8.0-1014.15UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-gcp5.15.0-1077.86UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-gcp6.8.0-1026.28UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-gcp-6.116.11.0-1011.11~24.04.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1026.28~22.04.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-gke5.15.0-1075.81UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-gke6.8.0-1021.25UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1060.68UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1008.10UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-57.59~22.04.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-ibm5.15.0-1070.73UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-ibm6.8.0-1022.22UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1023.23~22.04.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1073.79UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-kvm5.15.0-1076.81UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-133.143UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-56.58.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-56.58.1~22.04.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1072.73UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1024.27UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-nvidia-6.116.11.0-1007.7UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1024.27~22.04.1UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1024.27.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1033.33UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1004.4UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1021.21UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1015.15UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1024.24UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-oracle5.15.0-1075.81UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-oracle6.8.0-1022.23UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1022.23~22.04.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-raspi5.15.0-1072.75UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-raspi6.8.0-1028.32UBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-riscv6.8.0-56.58.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-56.58.1~22.04.1UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-50198
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1017.18UBUNTU-CVE-2024-50198
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1044.48UBUNTU-CVE-2024-50198

Affected products (as reported)

VendorProductVersions
Linux Linux 7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 – before bf3ab8e1c28f10df0823d4ff312f83c952b06a157b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 – before 50039aec43a82ad2495f2d0fb0c289c8717b4bb27b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 – before bcb90518ccd9e10bf6ab29e31994aab93e4a43617b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 – before 2cbb41abae65626736b8b52cf3b9339612c5a86a7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 – before 905166531831beb067fffe2bdfc98031ffe890877b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 – before c7c44e57750c31de43906d97813273fdffcf7d02
Linux Linux 5.5

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References