CVE-2024-54455

What it actually does

A missing NULL check on ctx before field access in ivpu_bo_list() allows a general protection fault via NULL pointer dereference in the Linux kernel accel/ivpu path.

Why it matters to the business

Potential kernel crashes or denial of service on systems using the affected acceleration driver, increasing operational risk on legacy qemu deployments until patched.

How an attack unfolds

An attacker supplies or triggers a code path that invokes ivpu_bo_list with a NULL context pointer, resulting in an unhandled general protection fault; no named threat actors or ransomware campaigns are associated.

How to fix it

Upgrade qemu on Ubuntu 14.04 LTS to version 2.0.0+dfsg-2ubuntu1.26 or newer; apply the kernel fix that adds the ctx != NULL check before field access.

How to confirm the fix worked

Confirm the installed qemu package version meets or exceeds 2.0.0+dfsg-2ubuntu1.26 and verify the NULL check is present in the ivpu_bo_list implementation.

Typical attack path

1. Locate a system exposing the vulnerable ivpu driver path
2. Trigger ivpu_bo_list with a NULL ctx parameter
3. Induce general protection fault leading to crash or instability

How to detect it

Search kernel logs and crash reports for general protection faults originating from ivpu_bo_list; monitor for NULL context dereference patterns post-publication.

What your security team should do

• Apply the fixed qemu package version immediately on all Ubuntu 14.04 LTS instances
• Review kernel logs for prior general protection faults referencing ivpu_bo_list
• Prioritize upgrade given the long window since publication