CVE-2024-56578

What it actually does

Failure to initialize video drvdata prior to device registration allows video_drvdata() to return NULL during open() file operations, resulting in a NULL pointer dereference and kernel oops.

Why it matters to the business

Systems using the affected Linux kernel media driver may experience crashes or instability, causing operational downtime and potential data loss in media processing workloads.

How an attack unfolds

An attacker with local access opens the affected video device node; because drvdata was never set, the kernel dereferences a NULL pointer in the open handler and triggers an oops. No named threat actors are known to exploit this issue.

How to fix it

Apply the upstream fix in commit f68bb1210fbea252552d97242757f69a219e942b or update to a kernel containing that change. For listed ntp packages on Ubuntu 16.04 LTS use version 1:4.2.8p4+dfsg-3ubuntu5.3; for Ubuntu 14.04 LTS use 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10.

How to confirm the fix worked

Confirm the kernel source contains commit f68bb1210fbea252552d97242757f69a219e942b and that video_drvdata() is called only after drvdata is set; test by exercising device open paths.

Typical attack path

1. Obtain local access to a system running an affected kernel build
2. Locate and open the imx-jpeg video device node
3. Trigger the open file operation before drvdata is populated
4. Cause NULL dereference and kernel oops

How to detect it

Review kernel logs for oops or NULL pointer dereference messages occurring during video device open operations; correlate with process activity opening media device nodes.

What your security team should do

• Prioritize kernel updates on systems exposing the imx-jpeg driver
• Monitor for oops reports referencing the media driver
• Restrict unprivileged access to video device nodes until patched