CVE-2024-56754

What it actually does

Mismatched pointer type (struct caam_drv_private *) passed to devm_add_action_or_reset() is cast to struct device * inside caam_qi_shutdown(), resulting in incorrect resource cleanup and memory corruption in the CAAM QI driver.

Why it matters to the business

Affected Linux systems using CAAM hardware may experience driver instability, failed cryptographic operations, or kernel crashes during module unload or device removal, with low immediate risk given stable low EPSS and no KEV listing.

How an attack unfolds

An attacker with local access triggers the CAAM driver shutdown path (module unload or device removal) to reach the mis-cast pointer and corrupt memory structures; listed threat actors have targeted similar Linux kernel memory issues in espionage and financially motivated campaigns, though public exploit maturity remains none.

How to fix it

Apply the kernel fix that passes the correct struct caam_drv_private * pointer to devm_add_action_or_reset(); for listed chromium-browser packages on Ubuntu 14.04 LTS update to version 52.0.2743.116-0ubuntu0.14.04.1.1134.

How to confirm the fix worked

Inspect the devm_add_action_or_reset() call site to confirm the pointer type matches the expected parameter in caam_qi_shutdown() and test driver load/unload cycles for clean resource release.

Typical attack path

1. Gain local access on a system using the CAAM crypto driver
2. Trigger driver unload or hardware removal to invoke shutdown
3. Abuse resulting memory corruption for denial of service or escalation

How to detect it

Search kernel logs and dmesg for CAAM QI shutdown errors, oops, or warnings referencing caam_qi_shutdown or devm_add_action_or_reset; monitor for unexpected process or module termination artifacts.

What your security team should do

• Prioritize patching affected kernels on systems with CAAM hardware
• Review logs for CAAM-related oops after driver changes
• Track EPSS stability and any new threat actor mentions for re-evaluation