PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2024-42255

CVE-2024-42255

kernel: tpm: Use auth only after NULL check in tpm_buf_check_hmac_response()

Loading…

Severity

Low

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · August 8, 2024

Updated · November 21, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

tpm: Use auth only after NULL check in tpm_buf_check_hmac_response()

Dereference auth after NULL check in tpm_buf_check_hmac_response(). Otherwise, unless tpm2_sessions_init() was called, a call can cause NULL dereference, when TCG_TPM2_HMAC is enabled.

[jarkko: adjusted the commit message.]

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE not specified