CVE-2024-27066 (GCVE-0-2024-27066)

Vulnerability from cvelistv5 – Published: 2024-05-01 13:04 – Updated: 2026-08-05 11:29
VLAI
Title
virtio: packed: fix unmap leak for indirect desc table
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio: packed: fix unmap leak for indirect desc table When use_dma_api and premapped are true, then the do_unmap is false. Because the do_unmap is false, vring_unmap_extra_packed is not called by detach_buf_packed. if (unlikely(vq->do_unmap)) { curr = id; for (i = 0; i < state->num; i++) { vring_unmap_extra_packed(vq, &vq->packed.desc_extra[curr]); curr = vq->packed.desc_extra[curr].next; } } So the indirect desc table is not unmapped. This causes the unmap leak. So here, we check vq->use_dma_api instead. Synchronously, dma info is updated based on use_dma_api judgment This bug does not occur, because no driver use the premapped with indirect.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-13 18:28 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b319940f83c21bb4c1fabffe68a862be879a6193 , < e142169aca5546ae6619c39a575cda8105362100 (git)
Affected: b319940f83c21bb4c1fabffe68a862be879a6193 , < 75450ff8c6fe8755bf5b139b238eaf9739cfd64e (git)
Affected: b319940f83c21bb4c1fabffe68a862be879a6193 , < 51bacd9d29bf98c3ebc65e4a0477bb86306b4140 (git)
Affected: b319940f83c21bb4c1fabffe68a862be879a6193 , < d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.23 , ≤ 6.6.* (semver)
Unaffected: 6.7.11 , ≤ 6.7.* (semver)
Unaffected: 6.8.2 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27066",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-13T18:28:27.748226Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-30T14:58:09.210Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:27:57.845Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e142169aca5546ae6619c39a575cda8105362100"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/virtio/virtio_ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e142169aca5546ae6619c39a575cda8105362100",
              "status": "affected",
              "version": "b319940f83c21bb4c1fabffe68a862be879a6193",
              "versionType": "git"
            },
            {
              "lessThan": "75450ff8c6fe8755bf5b139b238eaf9739cfd64e",
              "status": "affected",
              "version": "b319940f83c21bb4c1fabffe68a862be879a6193",
              "versionType": "git"
            },
            {
              "lessThan": "51bacd9d29bf98c3ebc65e4a0477bb86306b4140",
              "status": "affected",
              "version": "b319940f83c21bb4c1fabffe68a862be879a6193",
              "versionType": "git"
            },
            {
              "lessThan": "d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd",
              "status": "affected",
              "version": "b319940f83c21bb4c1fabffe68a862be879a6193",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/virtio/virtio_ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: packed: fix unmap leak for indirect desc table\n\nWhen use_dma_api and premapped are true, then the do_unmap is false.\n\nBecause the do_unmap is false, vring_unmap_extra_packed is not called by\ndetach_buf_packed.\n\n  if (unlikely(vq-\u003edo_unmap)) {\n                curr = id;\n                for (i = 0; i \u003c state-\u003enum; i++) {\n                        vring_unmap_extra_packed(vq,\n                                                 \u0026vq-\u003epacked.desc_extra[curr]);\n                        curr = vq-\u003epacked.desc_extra[curr].next;\n                }\n  }\n\nSo the indirect desc table is not unmapped. This causes the unmap leak.\n\nSo here, we check vq-\u003euse_dma_api instead. Synchronously, dma info is\nupdated based on use_dma_api judgment\n\nThis bug does not occur, because no driver use the premapped with\nindirect."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The only consumer of premapped mode is virtio-net\u0027s receive queues, and RX buffer resubmission (`try_fill_recv()`) is driven by consumption of inbound packets, so the leaking submit/detach cycle is exercised by a remote peer sending traffic to the interface. The vulnerable component is bound to the network stack and no credentials or local access are needed to drive it.\nAC:L - Nothing about the trigger depends on memory layout, timing, or a race \u2014 a remote party simply generates traffic and each buffer cycle leaks a mapping deterministically.\nPR:N - Driving virtio-net RX buffer churn requires no authentication or account on the target; an unauthenticated remote sender reaching the interface is sufficient.\nUI:N - No victim action is required; the RX refill and descriptor detach path runs automatically in NAPI context whenever packets arrive.\nS:U - The leaked DMA/IOVA resources and the exhaustion they cause are all within the same kernel security authority as the vulnerable virtio_ring code; no VM, IOMMU, or sandbox boundary is crossed by the party that can trigger the leak.\nC:N - The defect is purely a missing `dma_unmap_single()` in the accounting path \u2014 no out-of-bounds read, no kernel data reaches userspace, and the leaked swiotlb slot is never reused so its contents cannot cross-contaminate a later mapping.\nI:N - No memory is corrupted or modified by the bug itself; the stale IOMMU translation could only be abused by a deliberately malicious device or hypervisor, which under the virtio trust model already has full guest memory access, so no integrity is gained by the attacker who can actually trigger this.\nA:H - Every request leaks a streaming DMA mapping with no upper bound, exhausting swiotlb slots / IOVA space and growing IOMMU page tables and rbtree nodes until DMA mapping fails system-wide for all devices and the kernel runs out of memory \u2014 a hard denial of service, not mere degradation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:20.653Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e142169aca5546ae6619c39a575cda8105362100"
        },
        {
          "url": "https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64e"
        },
        {
          "url": "https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"
        }
      ],
      "title": "virtio: packed: fix unmap leak for indirect desc table",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27066",
    "datePublished": "2024-05-01T13:04:12.582Z",
    "dateReserved": "2024-02-19T14:20:24.216Z",
    "dateUpdated": "2026-08-05T11:29:20.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27066",
      "date": "2026-09-28",
      "epss": "0.00591",
      "percentile": "0.46114"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: packed: fix unmap leak for indirect desc table\n\nWhen use_dma_api and premapped are true, then the do_unmap is false.\n\nBecause the do_unmap is false, vring_unmap_extra_packed is not called by\ndetach_buf_packed.\n\n  if (unlikely(vq-\u003edo_unmap)) {\n                curr = id;\n                for (i = 0; i \u003c state-\u003enum; i++) {\n                        vring_unmap_extra_packed(vq,\n                                                 \u0026vq-\u003epacked.desc_extra[curr]);\n                        curr = vq-\u003epacked.desc_extra[curr].next;\n                }\n  }\n\nSo the indirect desc table is not unmapped. This causes the unmap leak.\n\nSo here, we check vq-\u003euse_dma_api instead. Synchronously, dma info is\nupdated based on use_dma_api judgment\n\nThis bug does not occur, because no driver use the premapped with\nindirect."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: virtio: empaquetado: corrige la fuga de desasignaci\u00f3n para la tabla desc indirecta Cuando use_dma_api y premapped son verdaderos, entonces do_unmap es falso. Debido a que do_unmap es falso, detach_buf_packed no llama a vring_unmap_extra_packed. if (improbable(vq-\u0026gt;do_unmap)) { curr = id; for (i = 0; i \u0026lt; estado-\u0026gt;num; i++) { vring_unmap_extra_packed(vq, \u0026amp;vq-\u0026gt;packed.desc_extra[curr]); curr = vq-\u0026gt;packed.desc_extra[curr].next; } } Por lo tanto, la tabla de descripci\u00f3n indirecta no est\u00e1 desasignada. Esto provoca la fuga de desasignaci\u00f3n. As\u00ed que aqu\u00ed marcamos vq-\u0026gt;use_dma_api en su lugar. Sincr\u00f3nicamente, la informaci\u00f3n de dma se actualiza seg\u00fan el criterio use_dma_api. Este error no ocurre porque ning\u00fan controlador utiliza el preasignado con indirecto."
        }
      ],
      "id": "CVE-2024-27066",
      "lastModified": "2024-11-21T09:03:47.367",
      "published": "2024-05-01T13:15:50.850",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64e"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/e142169aca5546ae6619c39a575cda8105362100"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64e"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/e142169aca5546ae6619c39a575cda8105362100"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2024-09-11T00:00:00.000Z",
      "cve": "CVE-2024-27066",
      "id": "msrc_CVE-2024-27066",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "virtio: packed: fix unmap leak for indirect desc table",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-27066.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/virtio/virtio_ring.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e142169aca5546ae6619c39a575cda8105362100",
                    "status": "affected",
                    "version": "b319940f83c21bb4c1fabffe68a862be879a6193",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "75450ff8c6fe8755bf5b139b238eaf9739cfd64e",
                    "status": "affected",
                    "version": "b319940f83c21bb4c1fabffe68a862be879a6193",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "51bacd9d29bf98c3ebc65e4a0477bb86306b4140",
                    "status": "affected",
                    "version": "b319940f83c21bb4c1fabffe68a862be879a6193",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd",
                    "status": "affected",
                    "version": "b319940f83c21bb4c1fabffe68a862be879a6193",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/virtio/virtio_ring.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.23",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.7.*",
                    "status": "unaffected",
                    "version": "6.7.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5B28A88F-F85F-4008-8F7C-44FC9152916E",
                    "versionEndExcluding": "6.6.23",
                    "versionStartIncluding": "6.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD",
                    "versionEndExcluding": "6.7.11",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "543A75FF-25B8-4046-A514-1EA8EDD87AB1",
                    "versionEndExcluding": "6.8.2",
                    "versionStartIncluding": "6.8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: packed: fix unmap leak for indirect desc table\n\nWhen use_dma_api and premapped are true, then the do_unmap is false.\n\nBecause the do_unmap is false, vring_unmap_extra_packed is not called by\ndetach_buf_packed.\n\n  if (unlikely(vq-\u003edo_unmap)) {\n                curr = id;\n                for (i = 0; i \u003c state-\u003enum; i++) {\n                        vring_unmap_extra_packed(vq,\n                                                 \u0026vq-\u003epacked.desc_extra[curr]);\n                        curr = vq-\u003epacked.desc_extra[curr].next;\n                }\n  }\n\nSo the indirect desc table is not unmapped. This causes the unmap leak.\n\nSo here, we check vq-\u003euse_dma_api instead. Synchronously, dma info is\nupdated based on use_dma_api judgment\n\nThis bug does not occur, because no driver use the premapped with\nindirect."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: virtio: empaquetado: corrige la fuga de desasignaci\u00f3n para la tabla desc indirecta Cuando use_dma_api y premapped son verdaderos, entonces do_unmap es falso. Debido a que do_unmap es falso, detach_buf_packed no llama a vring_unmap_extra_packed. if (improbable(vq-\u0026gt;do_unmap)) { curr = id; for (i = 0; i \u0026lt; estado-\u0026gt;num; i++) { vring_unmap_extra_packed(vq, \u0026amp;vq-\u0026gt;packed.desc_extra[curr]); curr = vq-\u0026gt;packed.desc_extra[curr].next; } } Por lo tanto, la tabla de descripci\u00f3n indirecta no est\u00e1 desasignada. Esto provoca la fuga de desasignaci\u00f3n. As\u00ed que aqu\u00ed marcamos vq-\u0026gt;use_dma_api en su lugar. Sincr\u00f3nicamente, la informaci\u00f3n de dma se actualiza seg\u00fan el criterio use_dma_api. Este error no ocurre porque ning\u00fan controlador utiliza el preasignado con indirecto."
          }
        ],
        "id": "CVE-2024-27066",
        "lastModified": "2026-08-04T11:17:40.297",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-27066",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-13T18:28:27.748226Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-01T13:15:50.850",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e142169aca5546ae6619c39a575cda8105362100"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64e"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e142169aca5546ae6619c39a575cda8105362100"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:06:37+00:00",
      "cve": "CVE-2024-27066",
      "id": "CVE-2024-27066",
      "initial_release_date": "2024-05-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: virtio: packed: fix unmap leak for indirect desc table",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27066.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:41:26Z",
      "cve": "CVE-2024-27066",
      "id": "CVE-2024-27066",
      "initial_release_date": "2024-05-04T02:23:07Z",
      "product_status:known_not_affected": "385",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-27066",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-27066.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:27:57.845Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/e142169aca5546ae6619c39a575cda8105362100"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64e"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-27066",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-13T18:28:27.748226Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-13T18:28:55.684Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/virtio/virtio_ring.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "e142169aca5546ae6619c39a575cda8105362100",
                  "status": "affected",
                  "version": "b319940f83c21bb4c1fabffe68a862be879a6193",
                  "versionType": "git"
                },
                {
                  "lessThan": "75450ff8c6fe8755bf5b139b238eaf9739cfd64e",
                  "status": "affected",
                  "version": "b319940f83c21bb4c1fabffe68a862be879a6193",
                  "versionType": "git"
                },
                {
                  "lessThan": "51bacd9d29bf98c3ebc65e4a0477bb86306b4140",
                  "status": "affected",
                  "version": "b319940f83c21bb4c1fabffe68a862be879a6193",
                  "versionType": "git"
                },
                {
                  "lessThan": "d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd",
                  "status": "affected",
                  "version": "b319940f83c21bb4c1fabffe68a862be879a6193",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/virtio/virtio_ring.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.6"
                },
                {
                  "lessThan": "6.6",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.23",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.7.*",
                  "status": "unaffected",
                  "version": "6.7.11",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.23",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.7.11",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.2",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: packed: fix unmap leak for indirect desc table\n\nWhen use_dma_api and premapped are true, then the do_unmap is false.\n\nBecause the do_unmap is false, vring_unmap_extra_packed is not called by\ndetach_buf_packed.\n\n  if (unlikely(vq-\u003edo_unmap)) {\n                curr = id;\n                for (i = 0; i \u003c state-\u003enum; i++) {\n                        vring_unmap_extra_packed(vq,\n                                                 \u0026vq-\u003epacked.desc_extra[curr]);\n                        curr = vq-\u003epacked.desc_extra[curr].next;\n                }\n  }\n\nSo the indirect desc table is not unmapped. This causes the unmap leak.\n\nSo here, we check vq-\u003euse_dma_api instead. Synchronously, dma info is\nupdated based on use_dma_api judgment\n\nThis bug does not occur, because no driver use the premapped with\nindirect."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The only consumer of premapped mode is virtio-net\u0027s receive queues, and RX buffer resubmission (`try_fill_recv()`) is driven by consumption of inbound packets, so the leaking submit/detach cycle is exercised by a remote peer sending traffic to the interface. The vulnerable component is bound to the network stack and no credentials or local access are needed to drive it.\nAC:L - Nothing about the trigger depends on memory layout, timing, or a race \u2014 a remote party simply generates traffic and each buffer cycle leaks a mapping deterministically.\nPR:N - Driving virtio-net RX buffer churn requires no authentication or account on the target; an unauthenticated remote sender reaching the interface is sufficient.\nUI:N - No victim action is required; the RX refill and descriptor detach path runs automatically in NAPI context whenever packets arrive.\nS:U - The leaked DMA/IOVA resources and the exhaustion they cause are all within the same kernel security authority as the vulnerable virtio_ring code; no VM, IOMMU, or sandbox boundary is crossed by the party that can trigger the leak.\nC:N - The defect is purely a missing `dma_unmap_single()` in the accounting path \u2014 no out-of-bounds read, no kernel data reaches userspace, and the leaked swiotlb slot is never reused so its contents cannot cross-contaminate a later mapping.\nI:N - No memory is corrupted or modified by the bug itself; the stale IOMMU translation could only be abused by a deliberately malicious device or hypervisor, which under the virtio trust model already has full guest memory access, so no integrity is gained by the attacker who can actually trigger this.\nA:H - Every request leaks a streaming DMA mapping with no upper bound, exhausting swiotlb slots / IOVA space and growing IOMMU page tables and rbtree nodes until DMA mapping fails system-wide for all devices and the kernel runs out of memory \u2014 a hard denial of service, not mere degradation."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:29:20.653Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/e142169aca5546ae6619c39a575cda8105362100"
            },
            {
              "url": "https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64e"
            },
            {
              "url": "https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140"
            },
            {
              "url": "https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"
            }
          ],
          "title": "virtio: packed: fix unmap leak for indirect desc table",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-27066",
        "datePublished": "2024-05-01T13:04:12.582Z",
        "dateReserved": "2024-02-19T14:20:24.216Z",
        "dateUpdated": "2026-08-05T11:29:20.653Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.