CVE-2024-56723

What it actually does

The driver fails to properly apply per-device IRQ domains when instantiating MFD child devices, causing platform_get_irq() to receive IRQ 0 (an invalid Linux vIRQ) and emit warnings; inherited hierarchy flaws prevent correct domain mapping across PMIC devices.

Why it matters to the business

On systems with the affected Intel PMIC, device initialization can produce kernel warnings or unstable power-management behavior, increasing operational noise and potential downtime for embedded or mobile Linux deployments; low exploitability keeps overall risk modest despite kernel-level reach.

How an attack unfolds

An attacker with local code execution or the ability to trigger PMIC device probe (for example via module load or hardware event) can force the flawed IRQ domain path, surfacing the WARN and potentially disrupting subsequent IRQ-dependent operations; listed threat actors have targeted similar kernel resource-handling issues in campaigns but this specific flaw shows no public exploitation.

How to fix it

Update to a kernel containing the fix that respects per-device IRQ domains during MFD creation; for the listed Ubuntu packages apply the referenced firefox 50.0+build2-0ubuntu0.14.04.2 or thunderbird 1:45.5.1+build1-0ubuntu0.14.04.1 updates where applicable and rebuild or replace any downstream kernel packages.

How to confirm the fix worked

After patching, confirm absence of the IRQ 0 WARN during PMIC device enumeration; inspect dmesg or kernel logs for successful IRQ domain hierarchy creation and verify platform_get_irq() returns valid vIRQs for each MFD child.

Typical attack path

1. Obtain local execution context on target Linux system
2. Trigger or wait for intel_soc_pmic_bxtwc probe and MFD child creation
3. Observe platform_get_irq() receiving IRQ 0 and resulting WARN
4. Leverage resulting instability or warning side-effects for further impact

How to detect it

Search kernel logs and dmesg for platform_get_irq warnings referencing IRQ 0 or intel_soc_pmic_bxtwc; correlate with MFD device creation events; review any threat-actor activity tied to Linux kernel uninitialized-resource or out-of-bounds issues for related indicators.

• platform_get_irq.*IRQ 0
• intel_soc_pmic_bxtwc.*WARN
• mfd.*IRQ domain

What your security team should do

• Prioritize kernel updates on systems using intel_soc_pmic_bxtwc
• Monitor EPSS and KEV status for any future increase in activity
• Add kernel warning patterns to SIEM for early detection of similar IRQ issues
• Limit local untrusted code execution on affected embedded platforms