CVE-2024-56739: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-56739 is a vulnerability discovered in the Linux kernel's RTC (Real-Time Clock) driver, specifically in the rtc_timer_do_work() function. The vulnerability was disclosed on December 29, 2024, affecting Linux kernel versions from 2.6.38 through 6.12.2. The issue occurs when the __rtc_read_time call fails, potentially leaving the struct rtc_time tm with uninitialized data or illegal date/time values from the RTC hardware (NVD).

The vulnerability stems from a failure to check the return value of __rtc_read_time in the rtc_timer_do_work() function. When this function fails, it may result in uninitialized or invalid data in the struct rtc_time tm structure. When this corrupted data is passed to rtc_tm_to_ktime, it can produce an extremely large value (possibly KTIME_MAX). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

If there are periodic timers in rtc->timerqueue, the vulnerability can cause these timers to continually expire, potentially resulting in kernel softlockup. This primarily affects system availability and stability (Kernel Patch).

The vulnerability requires local access with low privileges to exploit. No active exploits have been reported in the wild at the time of assessment (NVD).

The vulnerability has been patched in multiple kernel versions. The fix involves adding proper error checking for the __rtc_read_time call in rtc_timer_do_work(). When the call fails, the function now properly releases the mutex and returns, preventing the use of potentially corrupted time values (Kernel Patch).