CVE-2024-46715

What it actually does

Missing null checks before invoking optional callbacks in the iio_info structure allow unprivileged local users to trigger a NULL pointer dereference in the kernel when accessing certain sysfs attributes for IIO devices.

Why it matters to the business

A local attacker can crash the system, causing denial of service and potential data loss or disruption to services relying on the affected Linux kernel.

How an attack unfolds

An attacker with local access reads a sysfs entry corresponding to an unimplemented callback in an IIO driver, causing the kernel to dereference a null pointer and panic. Threat actors in espionage and financially motivated campaigns have targeted similar Linux kernel resource handling flaws.

How to fix it

Update the Linux kernel to the fixed commit 0cc7e0ee31e5c44904e98e2229d591e093282a70 or later versions that include the missing checks on iio_info callbacks.

How to confirm the fix worked

Verify kernel version includes the patch; attempt to access the relevant sysfs entries without triggering a NULL pointer dereference or oops.

Typical attack path

1. Obtain local user access on affected system
2. Identify IIO sysfs entries without implemented callbacks
3. Read the attribute to trigger NULL dereference
4. Kernel oops and potential system instability or crash

How to detect it

Inspect kernel logs for NULL pointer dereference traces involving iio_read_channel_info_avail, dev_attr_show, or sysfs attribute access in IIO drivers; correlate with local user activity on sysfs.

• iio_read_channel_info_avail
• Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute
• dev_attr_show+0x18/0x48

What your security team should do

• Apply the kernel patch containing commit 0cc7e0ee31e5c44904e98e2229d591e093282a70 immediately on affected systems
• Monitor kernel logs for IIO-related NULL pointer dereferences until patches are deployed
• Limit local unprivileged access to IIO device sysfs entries where feasible