CVE-2024-40945

MEDIUM EPSS 17.0%
Published Jul 12, 20241y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jul 12, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: iommu: Return right value in iommu_sva_bind_device() iommu_sva_bind_device() should return either a sva bond handle or an ERR_PTR value in error cases. Existing drivers (idxd and uacce) only check the return value with IS_ERR(). This could potentially lead to a kernel NULL pointer dereference issue if the function returns NULL instead of an error pointer. In reality, this doesn't cause any problems because iommu_sva_bind_device() only returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA. In this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will return an error, and the device drivers won't call iommu_sva_bind_device() at all.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
17.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-476 NULL Pointer Dereference Memory Safety

Affected Products 7

VendorProductVersionRange
linuxlinux_kernel*≥5.2  –  <5.4.279
linuxlinux_kernel*≥5.5  –  <5.10.221
linuxlinux_kernel*≥5.11  –  <5.15.162
linuxlinux_kernel*≥5.16  –  <6.6.35
linuxlinux_kernel*≥6.7  –  <6.9.6
linuxlinux_kernel6.10any
linuxlinux_kernel6.10any

References 11

  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-265688.html
  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-355557.html
  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-613116.html
  • git.kernel.org https://git.kernel.org/stable/c/2973b8e7d127754de9013177c41c0b5547406998
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/61a96da9649a6b6a1a5d5bde9374b045fdb5c12e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6325eab6c108fed27f60ff51852e3eac0ba23f3f
  • git.kernel.org https://git.kernel.org/stable/c/700f564758882db7c039dfba9443fe762561a3f8
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7388ae6f26c0ba95f70cc96bf9c5d5cb06c908b6
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/89e8a2366e3bce584b6c01549d5019c5cda1205e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cf34f8f66982a36e5cba0d05781b21ec9606b91e
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/2973b8e7d127754de9013177c41c0b5547406998
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/61a96da9649a6b6a1a5d5bde9374b045fdb5c12e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/700f564758882db7c039dfba9443fe762561a3f8
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7388ae6f26c0ba95f70cc96bf9c5d5cb06c908b6
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/89e8a2366e3bce584b6c01549d5019c5cda1205e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cf34f8f66982a36e5cba0d05781b21ec9606b91e
    Patch