IM
IronMonkey Threat Research

CVE-2024-43856 HIGH

Published: 2024-08-17 | Last Modified: 2026-08-04 | Status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: dma: fix call order in dmam_free_coherent dmam_free_coherent() frees a DMA allocation, which makes the freed vaddr available for reuse, then calls devres_destroy() to remove and free the data structure used to track the DMA allocation. Between the two calls, it is possible for a concurrent task to make an allocation with the same vaddr and add it to the devres list. If this happens, there will be two entries in the devres list with the same vaddr and devres_destroy() can free the wrong entry, triggering the WARN_ON() in dmam_match. Fix by destroying the devres entry before freeing the DMA allocation. kokonut //net/encryption http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03

Additional Descriptions (1)

En el kernel de Linux, se resolvió la siguiente vulnerabilidad: dma: corrige el orden de llamadas en dmam_free_coherent dmam_free_coherent() libera una asignación de DMA, lo que hace que el vaddr liberado esté disponible para su reutilización, luego llama a devres_destroy() para eliminar y liberar la estructura de datos utilizada para realizar un seguimiento de la asignación de DMA. Entre las dos llamadas, es posible que una tarea simultánea realice una asignación con el mismo vaddr y lo agregue a la lista de devres. Si esto sucede, habrá dos entradas en la lista devres con el mismo vaddr y devres_destroy() puede liberar la entrada incorrecta, activando WARN_ON() en dmam_match. Para solucionarlo, destruya la entrada devres antes de liberar la asignación de DMA. kokonut //net/encryption http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03

CVSS Metrics

Base Score: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Primary
en CWE-770

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd2dbccc1c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd36b352500> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd34bce3fc0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd34bce0740> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd2dbccfa40> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd2dbcceec0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd34bce1e80> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

References