CVE-2024-58004
Description
A flaw was found in the Linux kernel's Intel IPU6 driver. A local user could trigger this vulnerability to cause a Denial of Service (DoS) through a system crash. The issue occurs because the driver fails to remove CPU latency Quality of Service (QoS) requests during error handling before releasing associated memory, resulting in linked list corruption within the kernel power management subsystem.
Statement
This vulnerability is rated as Moderate severity because exploitation requires local access and is restricted to systems equipped with Intel IPU6 hardware, limiting the blast radius to a local denial of service via a system crash. Within the Intel IPU6 driver subsystem, failure to properly remove latency requests during error recovery leads to list corruption in the kernel power management framework. Enterprise platforms such as Red Hat Enterprise Linux 8 and 9 are unaffected as they do not include this driver code.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 7.8 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | High | High |
| Integrity Impact | None | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
