CVE-2024-54193

What it actually does

Incorrect runtime PM state in ivpu_ipc_send_receive_internal() when executed before ivpu_pm_enable() due to missing pm_runtime_set_active() in initialization, allowing a race condition that triggers kernel warnings.

Why it matters to the business

Potential system warnings or instability affecting hardware acceleration workloads on supported devices; low exploitation likelihood reduces immediate operational risk despite widespread Linux kernel presence.

How an attack unfolds

An attacker with local access triggers the IPC path before proper PM initialization completes, exploiting the race to hit the WARN condition; no known threat actors or ransomware usage observed.

How to fix it

Update qemu on Ubuntu 14.04 LTS to version 2.0.0+dfsg-2ubuntu1.26 or later; apply equivalent kernel patches ensuring pm_runtime_set_active() resides in ivpu_pm_init().

How to confirm the fix worked

Confirm package version meets or exceeds 2.0.0+dfsg-2ubuntu1.26; test ivpu initialization paths to verify absence of WARN in ivpu_ipc_send_receive_internal().

Typical attack path

1. Obtain local code execution on affected Linux system
2. Invoke ivpu IPC functions prior to PM enablement sequence
3. Trigger race condition in runtime state setup
4. Observe or leverage resulting kernel warning for denial of service or further chaining

How to detect it

Search kernel logs and dmesg for ivpu WARN messages referencing ivpu_ipc_send_receive_internal(); examine boot sequences for PM initialization ordering issues.

What your security team should do

• Prioritize patching qemu packages on all Ubuntu 14.04 LTS systems within standard maintenance windows
• Monitor kernel logs for ivpu-related WARN messages as a temporary detection measure
• Review downstream dependencies for any qemu-based virtualization workloads