CVE-2024-27038: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-27038 is a vulnerability in the Linux kernel's clock (clk) subsystem, discovered and reported on May 1, 2024. The vulnerability affects Linux kernel versions from 5.2 through 6.8.2, where a NULL pointer dereference can occur in the clk_core_get function (NVD).

The vulnerability occurs in a specific sequence of function calls: clk_core_get() -> of_clk_get_hw_from_clkspec() -> __of_clk_get_hw_from_provider() -> __clk_get_hw(). The __clk_get_hw() function can return NULL, which is then dereferenced by clk_core_get() at hw->core. This issue was introduced after commit dde4eff47c82 ('clk: Look for parents with clkdev based clk_lookups') removed an IS_ERR_OR_NULL() check that would have caught the NULL value (Kernel Patch).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The primary impact is a potential denial of service through a NULL pointer dereference (NVD).

The vulnerability requires local access with low privileges and no user interaction. The attack complexity is low, making it relatively straightforward to exploit for an attacker with the necessary access (NVD).

The vulnerability has been fixed in multiple Linux kernel versions through a patch that adds a NULL check before dereferencing the hw pointer. The fix has been backported to various stable kernel branches, and affected distributions have released updates. Ubuntu has released fixes for multiple kernel versions including 5.15.0-112.122 for 22.04 LTS and 5.4.0-189.209 for 20.04 LTS (Ubuntu).