PT-2024-29162 · Linux+7 · Linux Kernel+7
Lu Baolu
·
Published
2024-05-28
·
Updated
2026-01-12
·
CVE-2024-40945
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the
iommu sva bind device() function, which should return either a sva bond handle or an ERR PTR value in error cases. However, existing drivers, such as idxd and uacce, only check the return value with IS ERR(), potentially leading to a kernel NULL pointer dereference issue if the function returns NULL instead of an error pointer. In reality, this doesn't cause any problems because iommu sva bind device() only returns NULL when the kernel is not configured with CONFIG IOMMU SVA, and in this case, iommu dev enable feature(dev, IOMMU DEV FEAT SVA) will return an error, preventing the device drivers from calling iommu sva bind device().Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu