Lucene search

K
vulnrichmentLinuxVULNRICHMENT:CVE-2024-40945
HistoryJul 12, 2024 - 12:25 p.m.

CVE-2024-40945 iommu: Return right value in iommu_sva_bind_device()

2024-07-1212:25:19
Linux
github.com
linux kernel
vulnerability
iommu
sva
bind device
null pointer
dereference
error pointer
idxd
uacce
2024
40945

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

In the Linux kernel, the following vulnerability has been resolved:

iommu: Return right value in iommu_sva_bind_device()

iommu_sva_bind_device() should return either a sva bond handle or an
ERR_PTR value in error cases. Existing drivers (idxd and uacce) only
check the return value with IS_ERR(). This could potentially lead to
a kernel NULL pointer dereference issue if the function returns NULL
instead of an error pointer.

In reality, this doesn’t cause any problems because iommu_sva_bind_device()
only returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA.
In this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will
return an error, and the device drivers won’t call iommu_sva_bind_device()
at all.

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial