CVE-2024-45028

What it actually does

If the highmem allocation in mmc_test fails, a subsequent __free_pages call on the NULL pointer triggers a kernel NULL dereference, potentially causing a panic or undefined behavior instead of returning -ENOMEM.

Why it matters to the business

Affected Linux systems may experience kernel crashes during MMC/SD card testing under memory pressure, resulting in unplanned downtime for storage validation workloads; the low EPSS and absence from KEV indicate limited active exploitation risk but patching remains necessary for kernel stability.

How an attack unfolds

An attacker with local access induces memory exhaustion to force the alloc_pages failure path in mmc_test, triggering the NULL dereference and system instability; no widespread campaigns or ransomware usage reported despite mentions of espionage and financial actors targeting Linux kernel issues.

How to fix it

Apply the fix from commit e97be13a9f51284da450dd2a592e3fa87b49cdc9 in the Linux kernel stable tree; update any affected packages to the listed fixed versions such as the referenced GIT commit or equivalent backports; disable the mmc_test module if testing functionality is not required.

How to confirm the fix worked

Verify the presence of commit e97be13a9f51284da450dd2a592e3fa87b49cdc9 in the running kernel source or check for updated package versions; reproduce allocation failure scenarios in mmc_test to confirm -ENOMEM is returned without dereference.

Typical attack path

1. Obtain local user access on a system with the mmc_test module loaded
2. Create memory pressure to cause highmem allocation failure
3. Invoke mmc_test operations that trigger the buggy error path
4. Trigger NULL dereference leading to kernel panic or crash

How to detect it

Review kernel ring buffer and dmesg logs for NULL pointer dereference oops originating from mmc_test allocation or free paths; correlate with system memory pressure events around test module invocations.

What your security team should do

• Prioritize kernel updates containing the referenced commit for all production systems
• Audit systems for unnecessary loading of the mmc_test module and restrict its use
• Monitor kernel logs for related oops messages as a temporary detection measure
• Track EPSS trends and any new threat actor mentions for changes in exploit maturity