CVE-2024-42081

What it actually does

Null pointer dereference in the Xe DRM device coredump path that performs pointer assignments without first validating the coredump structure, allowing invalid memory access when the pointer is NULL.

Why it matters to the business

Kernel crashes and denial of service on Linux systems using Intel Xe graphics hardware, leading to unplanned downtime and potential loss of unsaved work until systems are updated.

How an attack unfolds

A local attacker triggers device coredump handling in the Xe driver under conditions where the coredump pointer remains NULL, causing the kernel to dereference invalid memory and panic.

How to fix it

Apply the upstream fix by updating to a kernel containing commit 76ec0e33707282d5321555698d902f4e067aff37 in the stable tree.

How to confirm the fix worked

Confirm the NULL check for coredump exists before the snapshot and device pointer assignments in xe_devcoredump.c after the update and test coredump paths do not panic.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Trigger Xe device coredump code path with a NULL coredump structure
3. Execute the unchecked pointer assignments to induce kernel panic

How to detect it

Inspect kernel logs and dmesg output for null pointer dereference faults originating from the drm/xe module around device coredump functions.

What your security team should do

• Apply the referenced kernel commit or newer stable release on all systems with Xe graphics
• Reboot affected hosts after patching to load the corrected driver
• Review kernel logs for prior Xe-related oops entries as part of post-patch validation