CVE-2024-47809

dlm: fix possible lkb_resource null dereference

MEDIUM
5.5
CVSS Score
Published: January 11, 2025 at 12:25 PM UTC
Updated: October 15, 2026 at 01:18 AM UTC
4 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 CPU 1518-4 Pn /dp MFP FirmwareSiplus S7-1500 CPU 1518-4 Pn /dp MFP Firmware

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: dlm: fix possible lkb_resource null dereference This patch fixes a possible null pointer dereference when this function is called from request_lock() as lkb->lkb_resource is not assigned yet, only after validate_lock_args() by calling attach_lkb(). Another issue is that a resource name could be a non printable bytearray and we cannot assume to be ASCII coded. The log functionality is probably never being hit when DLM is used in normal way and no debug logging is enabled. The null pointer dereference can only occur on a new created lkb that does not have the resource assigned yet, it probably never hits the null pointer dereference but we should be sure that other changes might not change this behaviour and we actually can hit the mentioned null pointer dereference. In this patch we just drop the printout of the resource name, the lkb id is enough to make a possible connection to a resource name if this exists.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

All versionsv < 6.6.666.7 ≤ v < 6.12.52.6.3043279e5376017c40b4be9af5bc79cbb4ef6f53d7
Vendor states this is fixed in 2db11504ef82a60c1a2063ba7431a5cd013ecfcb (fixed)
Vendor states this is fixed in 6fbdc3980b70e9c1c86eccea7d5ee68108008fa7 (fixed)
Vendor states this is fixed in 8d55ce46dd543c6965970ce70c22c3076dd35b1e (fixed)
Vendor states this is fixed in b98333c67daf887c724cd692e88e2db9418c0861 (fixed)
Vendor states this is fixed in e1ffea6bec96d4349dbfcc42ad3e436259f64243 (fixed)
Vendor states this is fixed in 2.6.30 (unaffected)
Vendor states this is fixed in 5.15.209 (unaffected)
Vendor states this is fixed in 6.1.167 (unaffected)
Vendor states this is fixed in 6.12.5 (unaffected)
Vendor states this is fixed in 6.13 (unaffected)
Vendor states this is fixed in 6.6.66 (unaffected)

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.5MEDIUMCISA-ADP
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card