Login Sign Up

CVE-2024-58056

5.5 MEDIUM

📋 TL;DR

This vulnerability in the Linux kernel's remoteproc subsystem causes a kernel warning when ida_free() is called on an unallocated ID during error handling in rproc_alloc(). This affects systems using the remoteproc framework, particularly STM32-based devices, causing potential system instability and denial of service.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)
Operating Systems: Linux
Default Config Vulnerable: ✅ No
Notes: Only vulnerable when remoteproc subsystem is used (typically in embedded systems, STM32 platforms). Requires CONFIG_REMOTEPROC=y.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash due to improper resource cleanup during error conditions in remoteproc initialization.

🟠

Likely Case

Kernel warning messages in system logs and potential denial of service for remoteproc-dependent functionality.

🟢

If Mitigated

Minor system log warnings with no functional impact if error conditions don't occur.

🌐 Internet-Facing: LOW - This is a kernel-level issue requiring local access or specific hardware initialization failures.
🏢 Internal Only: MEDIUM - Affects systems using remoteproc functionality, particularly embedded devices with STM32 processors.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: NO
Unauthenticated Exploit: ✅ No
Complexity: HIGH

Exploitation requires triggering specific error conditions during remoteproc initialization, making it difficult to weaponize.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in Linux kernel stable commits: 2cf54928e7e3, 7378aeb664e5, b32d60a852bb, e9efd9fa4679, f2013d19b770

Vendor Advisory: https://git.kernel.org/stable/c/2cf54928e7e32362215c69b68a6a53d110323bf3

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For embedded systems: Update kernel via vendor-provided patches or BSP updates. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable remoteproc subsystem

linux

Disable the vulnerable remoteproc subsystem if not needed

echo "blacklist remoteproc" >> /etc/modprobe.d/blacklist.conf
update-initramfs -u

🧯 If You Can't Patch

  • Monitor system logs for WARNING messages related to ida_free() calls
  • Avoid using or loading remoteproc modules and dependent hardware

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if remoteproc is loaded: lsmod | grep remoteproc && uname -r

Check Version:

uname -r

Verify Fix Applied:

Check if kernel version includes fix commits: git log --oneline | grep -E "(2cf54928e7e3|7378aeb664e5|b32d60a852bb|e9efd9fa4679|f2013d19b770)"

📡 Detection & Monitoring

Log Indicators:

  • WARNING: CPU: ... at lib/idr.c:525 ida_free+0x100/0x164
  • ida_free called for id=0 which is not allocated

Network Indicators:

  • None - this is a local kernel issue

SIEM Query:

source="kernel" AND "ida_free called for id=0"

📊 Metadata

CVE ID: CVE-2024-58056
CVSS v3 Score: 5.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score: 0.05% exploit probability (13.7th percentile)
Published: March 6, 2025
Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON