CVE-2024-41085
📋 TL;DR
This CVE describes a NULL pointer dereference vulnerability in the Linux kernel's CXL (Compute Express Link) subsystem. When the kernel attempts to auto-assemble persistent memory (pmem) regions during CXL endpoint port probing, it can dereference an uninitialized pointer (cxl_nvd), causing a kernel panic. This affects systems using CXL memory devices with Linux kernels containing the vulnerable code.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, potentially causing data loss or corruption if the crash occurs during critical operations.
Likely Case
System crash or instability when CXL memory devices are being initialized or during system boot with CXL hardware present.
If Mitigated
No impact if CXL hardware is not present or if the vulnerable code path is not triggered during normal operations.
🎯 Exploit Status
Exploitation requires triggering the vulnerable code path during CXL device initialization, which typically requires privileged access or specific hardware conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel commits: 1d064e4fbebcf5b18dc10c1f3973487eb163b600 and 84ec985944ef34a34a1605b93ce401aa8737af96
Vendor Advisory: https://git.kernel.org/stable/c/1d064e4fbebcf5b18dc10c1f3973487eb163b600
Restart Required: Yes
Instructions:
1. Update to a kernel version containing the fix commits. 2. Check your distribution's security advisories for backported patches. 3. Reboot the system after kernel update.
🔧 Temporary Workarounds
Disable CXL subsystem
linuxPrevent loading of CXL kernel modules to avoid triggering the vulnerability
echo 'blacklist cxl_pmem' >> /etc/modprobe.d/blacklist-cxl.conf
echo 'blacklist cxl_core' >> /etc/modprobe.d/blacklist-cxl.conf
update-initramfs -u
Disable CXL hardware
allDisable CXL devices in BIOS/UEFI if not required
🧯 If You Can't Patch
- Avoid using CXL memory devices until patched
- Implement monitoring for kernel panics related to CXL subsystem
🔍 How to Verify
Check if Vulnerable:
Check if CXL modules are loaded: lsmod | grep -E 'cxl_(pmem|core)' and check kernel version against patched versionsCheck Version:
uname -rVerify Fix Applied:
Verify kernel version includes fix commits: grep -q '1d064e4fbebcf5b18dc10c1f3973487eb163b600\|84ec985944ef34a34a1605b93ce401aa8737af96' /proc/version📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages containing 'cxl_pmem_region_probe'
- NULL pointer dereference errors in kernel logs
- System crashes during CXL device initialization
SIEM Query:
source="kernel" AND ("cxl_pmem" OR "NULL pointer dereference" OR "kernel panic")