CVE-2024-56568

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu: Defer probe of clients after smmu device bound

Null pointer dereference occurs due to a race between smmu

driver probe and client driver probe, when of_dma_configure()

for client is called after the iommu_device_register() for smmu driver

probe has executed but before the driver_bound() for smmu driver

has been called.

Following is how the race occurs:

T1:Smmu device probe T2: Client device probe

really_probe()

arm_smmu_device_probe()

iommu_device_register()

really_probe()

platform_dma_configure()

of_dma_configure()

of_dma_configure_id()

of_iommu_configure()

iommu_probe_device()

iommu_init_device()

arm_smmu_probe_device()

arm_smmu_get_by_fwnode()

driver_find_device_by_fwnode()

driver_find_device()

next_device()

klist_next()

/* null ptr

assigned to smmu */

/* null ptr dereference

while smmu->str

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References