Executive brief
A vulnerability in the Linux kernel's IPMI (Intelligent Platform Management Interface) driver could allow a local user to cause a system crash. The issue occurs because the system does not properly handle memory allocation failures when setting up certain hardware communication interfaces. This could lead to a denial-of-service, impacting the availability of servers and management operations.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's IPMB (IPM over Bus) driver within the `ipmb_probe` function in `drivers/char/ipmi/ipmb_dev_int.c`. The vulnerability is caused by a failure to check the return value of `devm_kasprintf()`, which can return NULL if memory allocation fails. If NULL is returned and subsequently used to populate `ipmb_dev->miscdev.name`, it leads to a kernel panic or crash during device registration. This is a local attack vector requiring low privileges, primarily resulting in a Denial of Service (DoS). Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.3 to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.76, 6.7 to 6.12.13, 6.13 to 6.13.2
Timeline
- 2024-09-26: patched: Initial patch submitted by Charles Han
- 2025-03-06: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1a8a17c5ce9cb5a82797602bff9819ac732d2ff5
- https://git.kernel.org/stable/c/2378bd0b264ad3a1f76bd957caf33ee0c7945351
- https://git.kernel.org/stable/c/312a6445036d692bc5665307eeafa4508c33c4b5
- https://git.kernel.org/stable/c/4c9caf86d04dcb10e9fd8cd9db8eb79b5bfcc4d8
- https://git.kernel.org/stable/c/a63284d415d4d114abd8be6e66a9558f3ca0702d
- https://git.kernel.org/stable/c/caac520350546e736894d14e051b64a9edb3600c
- https://git.kernel.org/stable/c/e529fbcf1f35f5fc3c839df7f06c3e3d02579715