Junglewise Threat Intelligence

CVE-2024-40945: Linux Kernel NULL pointer dereference in iommu_sva_bind_device

CVE-2024-40945 · Severity: medium · CVSS 5.5 · Published 2024-07-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's IOMMU component, which manages how hardware devices interact with system memory. Under specific configurations, certain device drivers could experience a system crash (NULL pointer dereference) when attempting to bind process address spaces. While the practical risk is low due to existing configuration checks, a successful exploit could lead to a denial-of-service by crashing the operating system.

Technical details

A vulnerability exists in the Linux kernel's IOMMU Shared Virtual Addressing (SVA) implementation. The function iommu_sva_bind_device() was designed to return either a valid handle or an ERR_PTR on failure; however, when CONFIG_IOMMU_SVA was disabled, it incorrectly returned NULL. Drivers such as idxd and uacce use the IS_ERR() macro to validate the return value, which does not catch NULL, leading to a potential NULL pointer dereference. The risk is mitigated in practice because iommu_dev_enable_feature() typically fails before this function is called in such configurations. The fix involves changing the return value to ERR_PTR(-ENODEV) to ensure proper error handling by calling drivers.

Affected products

  • Linux Linux Kernel 5.2 to 5.4.279, 5.5 to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.6.35, 6.7 to 6.9.6

Timeline

  • 2024-07-12: disclosed: CVE published
  • 2024-05-28: patched: Initial patch submitted by Lu Baolu

References

Related threats