CVE-2024-56580

What it actually does

The flaw causes dev_pm_domain_detach() to be invoked with a NULL or error pointer on the CAMSS power domain configuration error path, producing a kernel NULL pointer dereference during driver probe.

Why it matters to the business

Systems may experience kernel panics and loss of availability when the CAMSS driver probes before required power domains are registered; the issue affects Xen packages on older Ubuntu releases and can disrupt hypervisor-hosted workloads.

How an attack unfolds

An attacker with local access triggers the vulnerable probe path by ensuring the platform CAMCC driver is absent or unregistered, forcing camss_probe to take the error path and pass an invalid pointer to dev_pm_domain_detach, resulting in a crash.

How to fix it

Update xen packages on Ubuntu 14.04 LTS to version 4.4.2-0ubuntu0.14.04.6 and on Ubuntu 16.04 LTS to version 4.6.0-1ubuntu4.1; rebuild and ensure dependent platform drivers such as CAMCC are present before CAMSS initialization.

How to confirm the fix worked

Confirm installed package versions match the listed fixed releases, then attempt driver probe under the original failure conditions and verify the NULL dereference backtrace no longer appears in dmesg.

Typical attack path

1. Obtain local access on a system running a vulnerable Xen kernel package
2. Ensure the CAMCC driver is not built or registered
3. Trigger CAMSS driver probing via module load or device initialization
4. Cause the error path in camss_probe to execute dev_pm_domain_detach with NULL pointer

How to detect it

Search kernel logs and dmesg for the backtrace containing dev_pm_domain_detach and camss_probe along with the NULL pointer dereference message at address 00000000000001a2.

• dev_pm_domain_detach+0x8/0x48
• camss_probe+0x374/0x9c0
• Unable to handle kernel NULL pointer dereference at virtual address 00000000000001a2

What your security team should do

• Apply the listed package updates on all affected Ubuntu systems running Xen
• Audit build configurations to guarantee required power-domain drivers are included
• Monitor kernel logs for the specific dev_pm_domain_detach NULL dereference signature during driver initialization