CVE-2024-47756

What it actually does

Incorrect logical operator (&& instead of ||) in ks_pcie_quirk() causes the condition to evaluate incorrectly, potentially dereferencing a NULL pointer in the Linux kernel PCI keystone driver.

Why it matters to the business

Systems running affected Linux kernels on Keystone PCI hardware may experience unexpected crashes or instability, resulting in service interruptions and operational downtime; the large number of downstream Linux distributions increases exposure across server and embedded environments.

How an attack unfolds

An attacker with local access or the ability to influence PCI device configuration triggers the flawed if-statement in ks_pcie_quirk(), causing the kernel to dereference a NULL pointer and crash the system; while listed under broad zero-day and Linux kernel exploitation campaigns, no confirmed in-the-wild use exists for this specific flaw.

How to fix it

Update the Linux kernel to commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 or later; apply the corrected if-statement that uses || instead of && in ks_pcie_quirk().

How to confirm the fix worked

Verify the running kernel contains commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755; inspect the source of drivers/pci/controller/dwc/pcie-keystone.c to confirm the corrected logical expression; test PCI device enumeration on Keystone hardware to ensure no NULL dereference occurs.

Typical attack path

1. Obtain local execution or ability to manipulate PCI device enumeration on target system
2. Trigger PCI quirk handling path that reaches ks_pcie_quirk()
3. Force the buggy && condition to evaluate such that a NULL pointer is dereferenced
4. Cause kernel panic or memory corruption resulting in denial of service

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for NULL pointer dereference oops originating from pcie-keystone.c or ks_pcie_quirk(); correlate with PCI device attach events; no specific post-exploitation artifacts are known.

• BUG: unable to handle kernel NULL pointer dereference
• RIP: 0010:ks_pcie_quirk
• Call Trace:.*pci_assign_resource.*keystone

What your security team should do

• Immediately identify all systems running kernels prior to d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 and schedule patching
• Prioritize updates on any Keystone-based platforms due to direct hardware exposure
• Monitor kernel logs for NULL pointer dereference oops during PCI initialization
• Apply defense-in-depth by restricting unprivileged local access until patches are deployed