CVE-2024-47665

What it actually does

The vulnerability replaces a BUG_ON() assertion in I3C HCI driver IBI DMA setup with a graceful -EINVAL return when dma_get_cache_alignment multiplied by a defined value exceeds 256 during initialization.

Why it matters to the business

Affected Linux kernel deployments using I3C HCI hardware may experience kernel panics and system reboots on driver load under specific DMA alignment conditions, causing unplanned downtime and reduced device stability.

How an attack unfolds

An attacker loads or triggers initialization of the mipi-i3c-hci driver on a system where the cache alignment condition evaluates true, forcing the former BUG_ON() path to crash the kernel before the patch changes it to an error return.

How to fix it

Update the Linux kernel to the commit cacb76df247a7cd842ff29755a523b1cba6c0508 or later stable releases containing the fix that converts the BUG_ON() to an -EINVAL error return.

How to confirm the fix worked

Verify the presence of the patch by inspecting the i3c/mipi-i3c-hci driver source for the conditional error return instead of BUG_ON(), or confirm the running kernel is built from a tree containing commit cacb76df247a7cd842ff29755a523b1cba6c0508.

Typical attack path

1. Gain local access or ability to load the I3C HCI driver
2. Ensure hardware or configuration meets the dma_get_cache_alignment > 256 condition
3. Trigger driver initialization to hit the assertion
4. Cause kernel panic and denial of service

How to detect it

Examine kernel logs and dmesg output around driver initialization for BUG() or panic messages referencing IBI DMA or mipi-i3c-hci; correlate with system boot times and hardware enumeration events.

What your security team should do

• Apply the referenced kernel commit or newer release to all affected systems
• Test I3C HCI driver initialization on representative hardware after patching
• Monitor kernel logs for DMA alignment warnings during driver load
• Review boot and driver initialization processes for unexpected panics