CVE-2024-40945 iommu: Return right value in iommu_sva_bind_device()
A null pointer dereference in the Linux kernel IOMMU subsystem could cause a crash if specific configurations are bypassed, though currently mitigated by feature checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-40945?
CVE-2024-40945 is a medium-severity vulnerability in Linux kernel, published on 12 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iommu: Return right value in iommu_sva_bind_device()
iommu_sva_bind_device() should return either a sva bond handle or an ERR_PTR value in error cases. Existing drivers (idxd and uacce) only check the return value with IS_ERR(). This could potentially lead to a kernel NULL pointer dereference issue if the function returns NULL instead of an error pointer.
In reality, this doesn't cause any problems because iommu_sva_bind_device() only returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA. In this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will return an error, and the device drivers won't call iommu_sva_bind_device() at all.
Weakness: CWE-476
Which versions are affected by CVE-2024-40945?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-40945?
Apply the vendor's patch.
Is CVE-2024-40945 being exploited?
There is no known exploitation of CVE-2024-40945 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-40945, DEBIAN-CVE-2024-40945, GHSA-fh5c-w77m-vmmm, UBUNTU-CVE-2024-40945.