CVE-2024-56705

What it actually does

Missing null check after rgby_data allocation in ia_css_3a_statistics_allocate() allows a subsequent assert(host_stats->rgby_data) in ia_css_s3a_hmem_decode() to trigger on allocation failure, constituting a memory corruption class flaw in the atomisp media driver.

Why it matters to the business

Kernel instability or crashes on systems using the atomisp driver under memory pressure can interrupt camera and media pipelines, affecting embedded Linux devices and downstream dependents of the torvalds/linux repository.

How an attack unfolds

An attacker induces memory exhaustion to cause the unchecked rgby_data allocation to fail; the code path then reaches the unguarded assert in ia_css_s3a_hmem_decode(), producing a kernel panic or denial of service. Named actors in Linux kernel memory and out-of-bounds campaigns could leverage similar resource-exhaustion techniques.

How to fix it

Update torvalds/linux to commit 94710cac0ef4ee177a63b5227664b38c95bbf703 or later; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the allocation-failure check exists in ia_css_3a_statistics_allocate() by inspecting the source at the fixed commit and verify no assert triggers during memory-pressure testing of the atomisp driver.

Typical attack path

1. Exhaust system memory to force allocation failure
2. Trigger ia_css_3a_statistics_allocate() via atomisp media operations
3. Reach ia_css_s3a_hmem_decode() where the missing check leads to assert failure
4. Cause kernel panic or exploitable corruption state

How to detect it

Search kernel logs and dmesg for assertion failures referencing ia_css_s3a_hmem_decode or rgby_data; correlate with atomisp initialization under memory pressure. Review threat actor reports on Linux kernel resource and out-of-bounds issues for similar patterns.

What your security team should do

• Apply the referenced kernel commit immediately on all atomisp-using systems
• Include media driver stress tests in CI/CD pipelines
• Monitor kernel logs for atomisp and ia_css assertion messages
• Prioritize patching given the Linux kernel exposure and listed threat actor campaigns