Security readout for executives and security teams
Plain-English summary
CVE-2024-38548 is a Linux kernel availability bug in the Cadence MHDP8546 DRM bridge driver. If an internal kernel allocation fails, later code can dereference a null pointer and crash the affected path. The published CVSS is medium, and the impact is availability only.
Executive priority
Treat as a scheduled kernel maintenance item unless affected display systems are exposed to untrusted local users. It is not a remote code execution issue in the provided evidence.
Technical view
In cdns_mhdp_atomic_enable(), drm_mode_duplicate() can return NULL. The vulnerable code stores that value in mhdp_state->current_mode and then passes it to drm_mode_set_name(), causing a possible NULL pointer dereference. The fix adds a NULL check before dereference.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with the cdns-mhdp8546 DRM bridge driver present or used. The bundle does not identify affected distributions or downstream package versions.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, with high availability impact. The source bundle does not report active exploitation, and KEV status is false.
Researcher notes
The vulnerability is CWE-476 and maps cleanly to a defensive NULL-check fix. Evidence is limited to the CVE description, CVSS vector, KEV false status, affected kernel version metadata, and upstream stable commit references.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Prioritize systems using Cadence MHDP8546 display bridge support.
- Check distribution advisories for backported fixed kernel package versions.
- If immediate patching is unavailable, reduce untrusted local access where practical.
Validation and detection
- Inventory kernel versions against vendor fixed package guidance.
- Check whether the cdns-mhdp8546 driver is built, loaded, or required.
- Confirm patched source includes a NULL check for mhdp_state->current_mode.
- Review crash logs for NULL pointer dereferences in the DRM bridge path.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-38548 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/85d1a27402f81f2e04b0e67d20f749c2a14edbb3CVE reference, Linux
- https://git.kernel.org/stable/c/89788cd9824c28ffcdea40232c458233353d1896CVE reference, Linux
- https://git.kernel.org/stable/c/ca53b7efd4ba6ae92fd2b3085cb099c745e96965CVE reference, Linux
- https://git.kernel.org/stable/c/dcf53e6103b26e7458be71491d0641f49fbd5840CVE reference, Linux
- https://git.kernel.org/stable/c/32fb2ef124c3301656ac6c789a2ef35ef69a66daCVE reference, Linux
- https://git.kernel.org/stable/c/47889711da20be9b43e1e136e5cb68df37cbcc79CVE reference, Linux
- https://git.kernel.org/stable/c/935a92a1c400285545198ca2800a4c6c519c650aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.