CVE-2024-56540 accel/ivpu: Prevent recovery invocation during probe and resume
A race condition in the Intel VPU driver during probe and resume can cause kernel crashes via null pointer dereferences, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56540?
CVE-2024-56540 is a high-severity vulnerability in Linux kernel, published on 27 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Prevent recovery invocation during probe and resume
Refactor IPC send and receive functions to allow correct handling of operations that should not trigger a recovery process.
Expose ivpu_send_receive_internal(), which is now utilized by the D0i3 entry, DCT initialization, and HWS initialization functions. These functions have been modified to return error codes gracefully, rather than initiating recovery.
The updated functions are invoked within ivpu_probe() and ivpu_resume(), ensuring that any errors encountered during these stages result in a proper teardown or shutdown sequence. The previous approach of triggering recovery within these functions could lead to a race condition, potentially causing undefined behavior and kernel crashes due to null pointer dereferences.
Which versions are affected by CVE-2024-56540?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-56540?
Apply the vendor's patch.
Is CVE-2024-56540 being exploited?
There is no known exploitation of CVE-2024-56540 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-56540, DEBIAN-CVE-2024-56540, GHSA-h35x-4f36-345v, UBUNTU-CVE-2024-56540.