CVE-2024-56562

What it actually does

A copy/paste error in address variable handling within the I3C master driver leads to incorrect slot status management and failure to free init_dyn_addr, resulting in memory corruption.

Why it matters to the business

Potential system instability, crashes, or exploitable memory conditions on affected devices could disrupt operations and require urgent patching to avoid downtime or compromise, though prevalence remains limited.

How an attack unfolds

An attacker with local access or the ability to interact with I3C devices triggers the faulty path during address assignment, leveraging the un-freed resource for memory corruption; observed in broader Linux kernel campaigns by espionage and financially motivated actors.

How to fix it

Apply kernel updates that correct the init_dyn_addr reference in i3c_master_put_i3c_addrs; for listed distributions upgrade php5 to 5.5.9+dfsg-1ubuntu4.17 or php7.0 to 7.0.4-7ubuntu2.1 where applicable and rebuild or replace affected modules.

How to confirm the fix worked

Confirm the corrected source references init_dyn_addr instead of dyn_addr in the address release function and verify no memory leaks via kernel debugging tools after device enumeration.

Typical attack path

1. Identify systems exposing I3C master functionality or vulnerable kernel builds
2. Craft input or device interaction to reach i3c_master_put_i3c_addrs with mismatched address variables
3. Trigger the erroneous check and free operation to corrupt memory state
4. Escalate via the resulting corruption to execute arbitrary code or cause denial of service

How to detect it

Review kernel logs for I3C address assignment errors, memory allocation warnings, or crashes around i3c_master_put_i3c_addrs; correlate with process activity involving I3C device drivers and check for unexpected memory usage spikes.

• i3c_master_put_i3c_addrs
• init_dyn_addr
• i3c_bus_set_addr_slot_status

What your security team should do

• Prioritize kernel updates on all systems using I3C masters within the next patching cycle
• Monitor EPSS trend and threat actor reports for Linux kernel memory issues to adjust urgency
• Audit device trees and boardinfo configurations for init_dyn_addr usage
• Test updates in staging environments before broad deployment