CVE-2024-58004: media: intel/ipu6: remove cpu latency qos request on error
In the Linux kernel, the following vulnerability has been resolved:
media: intel/ipu6: remove cpu latency qos request on error
Fix cpu latency qos list corruption like below. It happens when we do not remove cpu latency request on error path and free corresponding memory.
[ 30.634378] l7 kernel: listadd corruption. prev->next should be next (ffffffff9645e960), but was 0000000100100001. (prev=ffff8e9e877e20a8). [ 30.634388] l7 kernel: WARNING: CPU: 2 PID: 2008 at lib/listdebug.c:32 listaddvalidorreport+0x83/0xa0 <snip> [ 30.634640] l7 kernel: Call Trace: [ 30.634650] l7 kernel: <TASK> [ 30.634659] l7 kernel: ? listaddvalidorreport+0x83/0xa0 [ 30.634669] l7 kernel: ? warn.cold+0x93/0xf6 [ 30.634678] l7 kernel: ? listaddvalidorreport+0x83/0xa0 [ 30.634690] l7 kernel: ? reportbug+0xff/0x140 [ 30.634702] l7 kernel: ? handlebug+0x58/0x90 [ 30.634712] l7 kernel: ? excinvalidop+0x17/0x70 [ 30.634723] l7 kernel: ? asmexcinvalidop+0x1a/0x20 [ 30.634733] l7 kernel: ? listaddvalidorreport+0x83/0xa0 [ 30.634742] l7 kernel: plistadd+0xdd/0x140 [ 30.634754] l7 kernel: pmqosupdatetarget+0xa0/0x1f0 [ 30.634764] l7 kernel: cpulatencyqosupdaterequest+0x61/0xc0 [ 30.634773] l7 kernel: inteldpauxxfer+0x4c7/0x6e0 [i915 1f824655ed04687c2b0d23dbce759fa785f6d033]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.15-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58004?
The severity of CVE-2024-58004 is classified as medium due to the potential for CPU latency request corruption.
How do I fix CVE-2024-58004?
To fix CVE-2024-58004, update the Linux kernel to the version that includes the patch addressing this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-58004?
CVE-2024-58004 affects Linux kernel versions from 6.10 to 6.12.14 and from 6.13 to 6.13.3.
What is the nature of the vulnerability in CVE-2024-58004?
CVE-2024-58004 involves the failure to remove CPU latency QoS requests on error paths, leading to potential memory corruption.
Is CVE-2024-58004 present in older versions of the Linux kernel?
CVE-2024-58004 is not present in older Linux kernel versions below 6.10, as it specifically affects the mentioned range.