CVE-2024-27047: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-27047 is a vulnerability in the Linux kernel's phy_get_internal_delay function, discovered and disclosed on May 1, 2024. The vulnerability affects Linux kernel versions from 5.9 through 6.8.2, impacting the network driver's PHY device functionality (NVD).

The vulnerability occurs in the phy_get_internal_delay function within the Linux kernel's net driver (phy_device.c). The function attempts to access an empty array when called without defining delay_values and rx-internal-delay-ps or tx-internal-delay-ps is set to 0 in the device-tree. This results in a NULL pointer dereference at virtual address 0. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and is classified as a NULL Pointer Dereference (CWE-476) (NVD).

When exploited, this vulnerability leads to a kernel NULL pointer dereference, resulting in a kernel oops condition that can cause system instability or denial of service (Kernel Patch).

The vulnerability requires local access and can be triggered when specific conditions are met in the device-tree configuration. The exploit complexity is low, requiring minimal access privileges to execute (NVD).

The vulnerability has been fixed by modifying the condition check in the phy_get_internal_delay function from 'if (delay && size 0)' to 'if (size 0)'. This patch has been integrated into various Linux kernel versions and is available through distribution-specific updates (Kernel Patch).