Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-27412
CVE-2024-27412:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2024-27412 is a vulnerability in the Linux kernel's power supply subsystem, specifically in the bq27xxx-i2c driver. The vulnerability was discovered on May 17, 2024, affecting the battery management functionality in Linux systems using the bq27xxx i2c-client (NVD).
Technical details
The vulnerability occurs when the bq27xxx i2c-client does not have an IRQ (Interrupt Request), resulting in client->irq being 0. While bq27xxxbatteryi2cprobe() correctly checks for client->irq before requesting a threaded IRQ, bq27xxxbatteryi2cremove() unconditionally calls free_irq(client->irq), leading to an attempt to free an already-free IRQ. This results in a kernel warning and backtrace when unbinding the driver (Kernel Commit). The vulnerability has been assigned a CVSS 3.1 base score of 5.5 (Medium) by CISA-ADP, with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).
Impact
The vulnerability can trigger a kernel warning and backtrace, potentially leading to system instability or denial of service conditions when attempting to unbind the bq27xxx i2c driver (NVD).
Mitigation and workarounds
The issue has been fixed by adding an if (client->irq) check to bq27xxxbatteryi2c_remove() to mirror the probe function's behavior. The fix has been implemented in various Linux distributions, including Ubuntu and Debian, through their respective security updates (Ubuntu Security, Debian LTS).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management