CVE-2024-56689

What it actually does

NULL pointer dereference in the Linux kernel PCI endpoint epf-mhi driver when platform_get_resource_byname() returns NULL due to a missing 'mmio' property in the device tree, causing an access to res->start without a prior NULL check.

Why it matters to the business

Potential kernel crash or denial of service on systems using the affected PCI endpoint MHI function, increasing operational risk and requiring urgent patching to maintain stability in embedded or endpoint Linux deployments.

How an attack unfolds

An attacker supplies or triggers a device tree configuration lacking the 'mmio' property for the MHI endpoint; when the driver initializes, the missing resource check leads to dereferencing a NULL pointer, crashing the kernel. Threat actor campaigns targeting Linux kernel resource handling vulnerabilities could leverage similar misconfigurations.

How to fix it

Apply the upstream kernel fix that adds the NULL check after platform_get_resource_byname(). For listed packages, upgrade imagemagick on Ubuntu 14.04 LTS to 8:6.7.7.10-6ubuntu3.11 and on Ubuntu 16.04 LTS to 8:6.8.9.9-7ubuntu5.11 (or later). Reboot after kernel or package updates.

How to confirm the fix worked

Confirm the patch is present by inspecting the epf-mhi source for the added NULL check on the resource pointer; test initialization with a device tree omitting 'mmio' and verify no crash occurs.

Typical attack path

1. Identify or control a system using the PCI endpoint epf-mhi driver
2. Provide a device tree without the required 'mmio' property
3. Trigger driver probe or initialization
4. Cause NULL dereference and kernel panic

How to detect it

Review kernel logs for NULL pointer dereference oops in epf-mhi or platform_get_resource_byname paths; examine device tree blobs and driver probe failures around MHI endpoint initialization. Correlate with any listed threat actor activity involving Linux kernel resource or out-of-bounds issues.

What your security team should do

• Prioritize kernel updates on all systems using PCI endpoint functionality
• Audit device tree configurations for required MHI properties
• Monitor for kernel oops or panics during endpoint driver load
• Apply fixed package versions for any dependent imagemagick installations