CVE-2024-58004 (GCVE-0-2024-58004)
Vulnerability from cvelistv5
Published
2025-02-27 02:12
Modified
2026-08-05 11:47
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: remove cpu latency qos request on error Fix cpu latency qos list corruption like below. It happens when we do not remove cpu latency request on error path and free corresponding memory. [ 30.634378] l7 kernel: list_add corruption. prev->next should be next (ffffffff9645e960), but was 0000000100100001. (prev=ffff8e9e877e20a8). [ 30.634388] l7 kernel: WARNING: CPU: 2 PID: 2008 at lib/list_debug.c:32 __list_add_valid_or_report+0x83/0xa0 <snip> [ 30.634640] l7 kernel: Call Trace: [ 30.634650] l7 kernel: <TASK> [ 30.634659] l7 kernel: ? __list_add_valid_or_report+0x83/0xa0 [ 30.634669] l7 kernel: ? __warn.cold+0x93/0xf6 [ 30.634678] l7 kernel: ? __list_add_valid_or_report+0x83/0xa0 [ 30.634690] l7 kernel: ? report_bug+0xff/0x140 [ 30.634702] l7 kernel: ? handle_bug+0x58/0x90 [ 30.634712] l7 kernel: ? exc_invalid_op+0x17/0x70 [ 30.634723] l7 kernel: ? asm_exc_invalid_op+0x1a/0x20 [ 30.634733] l7 kernel: ? __list_add_valid_or_report+0x83/0xa0 [ 30.634742] l7 kernel: plist_add+0xdd/0x140 [ 30.634754] l7 kernel: pm_qos_update_target+0xa0/0x1f0 [ 30.634764] l7 kernel: cpu_latency_qos_update_request+0x61/0xc0 [ 30.634773] l7 kernel: intel_dp_aux_xfer+0x4c7/0x6e0 [i915 1f824655ed04687c2b0d23dbce759fa785f6d033]
References
Impacted products
Vendor Product Version
Linux Linux Version: f50c4ca0a82003b8a542c3332fd292cf1bc355a2
Version: f50c4ca0a82003b8a542c3332fd292cf1bc355a2
Version: f50c4ca0a82003b8a542c3332fd292cf1bc355a2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/intel/ipu6/ipu6-isys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1496ec94bd38bdb25ca13b1dd4f8e7a6176ea89d",
              "status": "affected",
              "version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2",
              "versionType": "git"
            },
            {
              "lessThan": "95275736185ecb71dc97a71d8d9d19e4ffb0a9eb",
              "status": "affected",
              "version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2",
              "versionType": "git"
            },
            {
              "lessThan": "facb541ff0805314e0b56e508f7d3cbd07af513c",
              "status": "affected",
              "version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/intel/ipu6/ipu6-isys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: intel/ipu6: remove cpu latency qos request on error\n\nFix cpu latency qos list corruption like below. It happens when\nwe do not remove cpu latency request on error path and free\ncorresponding memory.\n\n[   30.634378] l7 kernel: list_add corruption. prev-\u003enext should be next (ffffffff9645e960), but was 0000000100100001. (prev=ffff8e9e877e20a8).\n[   30.634388] l7 kernel: WARNING: CPU: 2 PID: 2008 at lib/list_debug.c:32 __list_add_valid_or_report+0x83/0xa0\n\u003csnip\u003e\n[   30.634640] l7 kernel: Call Trace:\n[   30.634650] l7 kernel:  \u003cTASK\u003e\n[   30.634659] l7 kernel:  ? __list_add_valid_or_report+0x83/0xa0\n[   30.634669] l7 kernel:  ? __warn.cold+0x93/0xf6\n[   30.634678] l7 kernel:  ? __list_add_valid_or_report+0x83/0xa0\n[   30.634690] l7 kernel:  ? report_bug+0xff/0x140\n[   30.634702] l7 kernel:  ? handle_bug+0x58/0x90\n[   30.634712] l7 kernel:  ? exc_invalid_op+0x17/0x70\n[   30.634723] l7 kernel:  ? asm_exc_invalid_op+0x1a/0x20\n[   30.634733] l7 kernel:  ? __list_add_valid_or_report+0x83/0xa0\n[   30.634742] l7 kernel:  plist_add+0xdd/0x140\n[   30.634754] l7 kernel:  pm_qos_update_target+0xa0/0x1f0\n[   30.634764] l7 kernel:  cpu_latency_qos_update_request+0x61/0xc0\n[   30.634773] l7 kernel:  intel_dp_aux_xfer+0x4c7/0x6e0 [i915 1f824655ed04687c2b0d23dbce759fa785f6d033]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is a PCI/auxiliary-bus camera driver probe path, and the resulting corrupted global PM-QoS list is exercised through local interfaces (ALSA PCM ioctls, DRM ioctls, cpuidle). There is no network-reachable path to either the corruption or its exploitation.\nAC:L - On an affected system the dangling plist node is established deterministically during boot whenever isys_probe() fails (the reported real-world case on Intel IPU6 laptops), and from there the attacker\u0027s steps \u2014 heap-spraying the freed devres allocation and issuing SNDRV_PCM_IOCTL_HW_PARAMS to force plist_add() \u2014 are fully repeatable with no race to win and no memory layout the attacker cannot influence.\nPR:L - A plain unprivileged local user account suffices: /dev/snd PCM hw_params reaches cpu_latency_qos_add_request() directly, and heap spraying of the freed kmalloc object needs no capabilities. No root, CAP_SYS_ADMIN, or namespace privileges are required.\nUI:N - The corrupted global PM-QoS list already exists after boot on the affected configuration, and the attacker triggers traversal of it entirely on their own via ordinary ioctls. No victim action is needed.\nS:U - The use-after-free and any resulting privilege escalation are confined to the kernel of the same machine, managed by a single security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a globally reachable list node; plist_add()/plist_del() dereference attacker-controlled pointers read out of the reclaimed object, yielding arbitrary kernel memory reads and disclosure of freed-object/kernel-pointer contents.\nI:H - With the freed object reclaimed by attacker-controlled data, plist_add()\u0027s list_add_tail() writes list pointers into attacker-chosen kernel addresses (CONFIG_DEBUG_LIST is off on production kernels), giving a write-what-where primitive suitable for control-flow hijack and privilege escalation.\nA:H - The corrupted plist is walked under the pm_qos_lock raw spinlock by many subsystems, so it reliably produces list-corruption WARNINGs, oopses, or an unrecoverable hard lockup \u2014 the reporter observed exactly this crash path from i915\u0027s DP AUX transfer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:22.343Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1496ec94bd38bdb25ca13b1dd4f8e7a6176ea89d"
        },
        {
          "url": "https://git.kernel.org/stable/c/95275736185ecb71dc97a71d8d9d19e4ffb0a9eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/facb541ff0805314e0b56e508f7d3cbd07af513c"
        }
      ],
      "title": "media: intel/ipu6: remove cpu latency qos request on error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58004",
    "datePublished": "2025-02-27T02:12:01.426Z",
    "dateReserved": "2025-02-27T02:10:48.226Z",
    "dateUpdated": "2026-08-05T11:47:22.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.