CVE-2024-38575

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to a null pointer dereference bug in the Linux kernel, specifically in the wifi: brcmfmac: pcie component. This bug occurs when the physical memory runs out, causing the kzalloc() function in brcmf pcie download fw nvram() to return null. As a result, using get random bytes() to generate random bytes in the randbuf can lead to a null pointer dereference. To prevent allocation failure, a separate function has been added to use a buffer on the kernel stack to generate random bytes in the randbuf, which can prevent the kernel stack from overflowing.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.