CVE-2024-42235: 
CBL Mariner vulnerability analysis and mitigation

CVE-2024-42235 affects the Linux kernel's s390/mm subsystem. The vulnerability was discovered in the crst_table_free() and base_crst_free() functions, which previously handled NULL pointers before being converted to use ptdescs. The issue affects Linux kernel versions from 6.6 up to (excluding) 6.6.41 and from 6.7 up to (excluding) 6.9.10 (NVD).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) with a CVSS v3.1 base score of 5.5 (Medium), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The issue stems from the conversion of various pgalloc functions to use ptdescs, where crst_table_free() could be called with a NULL pointer during error handling in crst_table_upgrade(). The vulnerability was fixed by adding explicit NULL pointer checks to both crst_table_free() and base_crst_free() functions (Kernel Patch).

The vulnerability's impact is primarily focused on system availability. While the issue is rated as medium severity, it's noted that in real-world scenarios, this condition should not typically occur since order two GFP_KERNEL allocations will not fail unless FAIL_PAGE_ALLOC is enabled and used (Kernel Patch).

The vulnerability requires local access with low complexity and low privileges to exploit. No active exploits have been reported in the wild, and the condition is noted to be unlikely in real-life scenarios unless specific debugging features are enabled (NVD).

The vulnerability has been patched in the Linux kernel by adding NULL pointer checks to the affected functions. Users should upgrade to Linux kernel versions 6.6.41 or later for the 6.6 series, or 6.9.10 or later for newer versions. The fix involves adding explicit NULL pointer checks before calling pagetable_free() in both crst_table_free() and base_crst_free() functions (Kernel Patch).