CVE-2024-56691: Linux kernel vulnerability in MFD driver affecting USB Type-C devices

In the Linux kernel, a critical vulnerability (CVE-2024-56691) has recently been resolved. The issue lies in the Multi-Function Device (MFD) driver, specifically with the Intel SoC PMIC BXTWC module. The vulnerability affects the handling of USB Type-C devices and their proper function.

Original References

1. Linux kernel source
2. Patch for the vulnerability

Exploit Details

The vulnerability was discovered when the platform_get_irq() function began to throw warnings on IRQ , which is supposed to be a Linux IRQ number (also known as vIRQ). The design for converting the driver to use the hierarchy of IRQ chips is conceptually sound, but the current implementation inherited flaws.

To address the issue and improve the security and functionality of the Linux kernel, the driver has been reworked so that it respects the IRQ domain when creating each MFD device separately. This is critical because the domain is not the same for all devices.

The following code snippet demonstrates the patch applied to resolve this CVE

--- a/drivers/mfd/intel_soc_pmic_bxtwc.c
+++ b/drivers/mfd/intel_soc_pmic_bxtwc.c
@@ -22,7 +22,6 @@
 static const struct mfd_cell bxtwc_dev[] = {
        {
                .name = "bxt_wcove_region",
-               .irq = ,
                .id = 1,
        }, {
                .name = "bxt_wcove_region",
@@ -33,7 +32,6 @@
                {
                        .name = "bxt_wcove_region",
                        .id = 3,
-                       .irq = ,
                        .platform_data = &irq_pdata,
                        .pdata_size = sizeof(irq_pdata),
                },

This patch modifies the drivers/mfd/intel_soc_pmic_bxtwc.c file to ensure proper handling of IRQ domains for each MFD device.

To protect your Linux systems from this vulnerability (CVE-2024-56691), it is essential to update your kernel to the latest version available. Regularly checking for kernel updates and patches can help ensure the security and functionality of your devices.

Timeline

Published on: 12/28/2024 10:15:14 UTC
Last modified on: 01/20/2025 06:26:17 UTC