CVE-2024-56724

What it actually does

The flaw stems from incorrect IRQ domain handling in the intel_soc_pmic_bxtwc MFD driver, where platform_get_irq() receives IRQ 0 (invalid as a Linux vIRQ) instead of a proper domain-mapped IRQ, inherited from prior hierarchy conversion flaws.

Why it matters to the business

Systems using affected Intel PMIC hardware may experience warnings, instability, or boot issues; with low but stable EPSS and no KEV listing, operational impact is limited to reliability rather than widespread exploitation, though Linux ecosystem prevalence amplifies patch urgency.

How an attack unfolds

An attacker with local access triggers MFD device creation paths that expose the IRQ domain mismatch; listed threat actors in Linux kernel campaigns could combine this with uninitialized resource or out-of-bounds issues for denial-of-service, though no public exploits are known given zero EPSS trend change.

How to fix it

Update the Linux kernel to incorporate the IRQ domain rework for the intel_soc_pmic_bxtwc driver; for listed Firefox packages on Ubuntu 14.04 LTS apply the fixed version 50.0+build2-0ubuntu0.14.04.2 where applicable, ensuring all MFD child devices respect separate IRQ domains.

How to confirm the fix worked

Confirm kernel source contains the updated mfd driver code that calls irq_domain_alloc_irqs per device; test platform_get_irq() returns valid vIRQs greater than zero without WARN() on IRQ 0; verify no regression in PMIC functionality post-update.

Typical attack path

1. Obtain local access to target system
2. Trigger platform device enumeration involving the BXTWC PMIC
3. Invoke platform_get_irq() on TMU child devices
4. Force use of IRQ 0 outside the proper IRQ domain
5. Induce kernel warnings or resource allocation failures

How to detect it

Review kernel logs for platform_get_irq WARN messages referencing IRQ 0; inspect dmesg or syslog for MFD device creation failures around intel_soc_pmic_bxtwc; correlate with local process activity attempting device access, though no specific ransomware IOCs apply.

What your security team should do

• Prioritize kernel updates on Intel-based embedded or mobile platforms within 30 days given publication age
• Audit custom drivers or out-of-tree MFD code for similar IRQ domain assumptions
• Monitor for local privilege escalation attempts combining this with other kernel flaws
• Apply the exact fixed package versions provided for any overlapping Firefox deployments