CVE-2024-45828

What it actually does

Race condition in I3C HCI DMA mode allows RING_OP_STAT interrupt after io_data pointer is set to NULL during hci_dma_cleanup, causing NULL pointer dereference in hci_dma_irq_handler.

Why it matters to the business

Affected Linux kernel systems may crash or become unstable during bus cleanup operations, resulting in unplanned downtime and potential loss of availability for dependent services.

How an attack unfolds

An attacker triggers DMA ring stop operations while timing interrupt delivery to occur after pointer nullification in the cleanup path, leading to the dereference; no widespread threat actor activity or ransomware use reported.

How to fix it

Apply kernel updates containing commit a6cddf68b3405b272b5a3cad9657be0b02b34bf4 or equivalent fixed versions for affected distributions; mask ring interrupts before ring stop requests as described in the resolution.

How to confirm the fix worked

Confirm presence of interrupt masking code prior to ring stop in mipi-i3c-hci driver source; verify running kernel includes the referenced commit or later stable equivalent.

Typical attack path

1. Gain local execution context on target system
2. Trigger I3C bus cleanup path involving DMA ring stop
3. Exploit timing window to invoke interrupt handler post-nullification
4. Trigger NULL pointer dereference and kernel fault

How to detect it

Search kernel logs and crash dumps for references to hci_dma_irq_handler, RING_OP_STAT interrupts, and NULL dereferences originating from the I3C HCI DMA cleanup path.

• hci_dma_irq_handler
• RING_OP_STAT
• hci_dma_cleanup

What your security team should do

• Prioritize kernel upgrades on systems using I3C HCI DMA mode
• Review and apply fixed versions from distribution packages
• Monitor kernel logs for related panic signatures during routine operations