CVE-2024-58004

Deeper analysis

CVE-2024-58004 is a vulnerability in the Linux kernel's media subsystem, specifically the Intel IPU6 driver. The issue arises from a failure to remove a CPU latency QoS request on error paths before freeing the corresponding memory, leading to CPU latency QoS list corruption. This manifests as a list_add corruption error, as evidenced by kernel warnings such as "list_add corruption. prev->next should be next (ffffffff9645e960), but was 0000000100100001," triggered during operations like intel_dp_aux_xfer in the i915 driver. The vulnerability is classified under CWE-787 (Out-of-bounds Write) with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A local attacker with low privileges can exploit this vulnerability by triggering the error path in the Intel IPU6 driver. Exploitation requires low complexity and no user interaction, potentially allowing the attacker to corrupt kernel QoS lists. This can result in high-impact consequences, including unauthorized access to sensitive data (high confidentiality), modification of system integrity (high integrity), and disruption of system availability (high availability), such as kernel panics or further compromise.

Mitigation involves applying upstream patches from the Linux kernel stable repository, including commits such as 1496ec94bd38bdb25ca13b1dd4f8e7a6176ea89d, 95275736185ecb71dc97a71d8d9d19e4ffb0a9eb, and facb541ff0805314e0b56e508f7d3cbd07af513c, which fix the QoS request removal on error paths in the ipu6 driver. Security practitioners should update affected Linux kernels to incorporate these fixes.