cbcvebase.
CVE-2024-56568
published 2024-12-27

CVE-2024-56568: In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Defer probe of clients after smmu device bound Null pointer dereference…

PriorityP416medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.16%
5.8th percentile
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Defer probe of clients after smmu device bound Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when of_dma_configure() for client is called after the iommu_device_register() for smmu driver probe has executed but before the driver_bound() for smmu driver has been called. Following is how the race occurs: T1:Smmu device probe T2: Client device probe really_probe() arm_smmu_device_probe() iommu_device_register() really_probe() platform_dma_configure() of_dma_configure() of_dma_configure_id() of_iommu_configure() iommu_probe_device() iommu_init_device() arm_smmu_probe_device() arm_smmu_get_by_fwnode() driver_find_device_by_fwnode() driver_find_device() next_device() klist_next() /* null ptr assigned to smmu */ /* null ptr dereference while smmu->streamid_mask */ driver_bound() klist_add_tail() When this null smmu pointer is dereferenced later in arm_smmu_probe_device, the device crashes. Fix this by deferring the probe of the client device until the smmu device has bound to the arm smmu driver. [will: Add comment]

Affected

24 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.123-1 (bookworm)linux 6.1.123-1 (bookworm)
debianlinux-6.1< linux 6.1.123-1 (bookworm)linux 6.1.123-1 (bookworm)
linuxlinux
linuxlinux>= 021bb8420d44cf56102d44fca9af628625e75482 < c2527d07c7e9cda2c6165d5edccf74752baac1b0c2527d07c7e9cda2c6165d5edccf74752baac1b0
linuxlinux>= 021bb8420d44cf56102d44fca9af628625e75482 < dc02407ea952e20c544a078a6be2e6f008327973dc02407ea952e20c544a078a6be2e6f008327973
linuxlinux>= 021bb8420d44cf56102d44fca9af628625e75482 < f8f794f387ad21c4696e5cd0626cb6f8a5f6aea5f8f794f387ad21c4696e5cd0626cb6f8a5f6aea5
linuxlinux>= 021bb8420d44cf56102d44fca9af628625e75482 < 4a9485918a042e3114890dfbe19839a1897f8b2c4a9485918a042e3114890dfbe19839a1897f8b2c
linuxlinux>= 021bb8420d44cf56102d44fca9af628625e75482 < 5018696b19bc6c021e934a8a59f4b1dd8c0ac9f85018696b19bc6c021e934a8a59f4b1dd8c0ac9f8
linuxlinux>= 021bb8420d44cf56102d44fca9af628625e75482 < 229e6ee43d2a160a1592b83aad620d6027084aad229e6ee43d2a160a1592b83aad620d6027084aad
linuxlinux_kernel>= 0 < 5.10.234-15.10.234-1
linuxlinux_kernel>= 0 < 6.1.123-16.1.123-1
linuxlinux_kernel>= 0 < 6.12.5-16.12.5-1
linuxlinux_kernel>= 0 < 6.12.5-16.12.5-1
linuxlinux_kernel>= 0 < 5.15.0-135.1465.15.0-135.146
linuxlinux_kernel>= 0 < 6.8.0-58.606.8.0-58.60
linuxlinux_kernel>= 4.9 < 5.10.2315.10.231
linuxlinux_kernel>= 5.11 < 5.15.1745.15.174
linuxlinux_kernel>= 5.16 < 6.1.1206.1.120
linuxlinux_kernel>= 6.2 < 6.6.666.6.66
linuxlinux_kernel>= 6.7 < 6.12.46.12.4
msrcazl3_kernel_6.6.64.2-9_on_azure_linux_3.0
msrcazl3_kernel_6.6.76.1-1_on_azure_linux_3.0
msrccbl2_kernel_5.15.173.1-2_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.176.3-1_on_cbl_mariner_2.0

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian4.7MEDIUM
vendor_msrc4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.