CVE-2024-27408 (GCVE-0-2024-27408)

Vulnerability from cvelistv5 – Published: 2024-05-17 11:50 – Updated: 2026-08-05 11:29
VLAI
Title
dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup The Linked list element and pointer are not stored in the same memory as the eDMA controller register. If the doorbell register is toggled before the full write of the linked list a race condition error will occur. In remote setup we can only use a readl to the memory to assure the full write has occurred.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7e4b8a4fbe2cecab0959e862604803d063f50029 , < d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3 (git)
Affected: 7e4b8a4fbe2cecab0959e862604803d063f50029 , < f396b4df27cfe01a99f4b41f584c49e56477be3a (git)
Affected: 7e4b8a4fbe2cecab0959e862604803d063f50029 , < bbcc1c83f343e580c3aa1f2a8593343bf7b55bba (git)
Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 6.6.21 , ≤ 6.6.* (semver)
Unaffected: 6.7.9 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27408",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T16:00:32.783313Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:46:41.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:34:52.272Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/dw-edma/dw-edma-v0-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3",
              "status": "affected",
              "version": "7e4b8a4fbe2cecab0959e862604803d063f50029",
              "versionType": "git"
            },
            {
              "lessThan": "f396b4df27cfe01a99f4b41f584c49e56477be3a",
              "status": "affected",
              "version": "7e4b8a4fbe2cecab0959e862604803d063f50029",
              "versionType": "git"
            },
            {
              "lessThan": "bbcc1c83f343e580c3aa1f2a8593343bf7b55bba",
              "status": "affected",
              "version": "7e4b8a4fbe2cecab0959e862604803d063f50029",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/dw-edma/dw-edma-v0-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.21",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup\n\nThe Linked list element and pointer are not stored in the same memory as\nthe eDMA controller register. If the doorbell register is toggled before\nthe full write of the linked list a race condition error will occur.\nIn remote setup we can only use a readl to the memory to assure the full\nwrite has occurred."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable sequence is reached only through the local dmaengine client API (`dma_async_issue_pending()` \u2192 `dw_edma_device_issue_pending()` \u2192 `dw_edma_v0_core_start()`), i.e. via a device node or in-kernel client on the host driving the remote eDMA. There is no network- or packet-facing path into drivers/dma/dw-edma/.\nAC:L - An attacker able to submit transfers can repeat them indefinitely at no cost and can widen the window at will by building large scatter-gather lists, since every chunk re-writes the LL and rings the doorbell again \u2014 and per the commit, on affected remote setups the unordered doorbell simply races the LL writes rather than requiring an unusual condition.\nPR:L - No capability check exists on the path \u2014 the dmaengine core imposes none, so an unprivileged local account with ordinary access to a client device node backed by these eDMA channels is sufficient to issue the transfers that ring the doorbell.\nUI:N - The attacker drives the entire submit/complete cycle on its own; no action by another user or administrator is needed, and an already-bound dw-edma-pcie device is system configuration rather than victim interaction.\nS:U - The corrupted transfers act on host memory already within the DMA mapping the kernel authorized for this device, all under the same kernel security authority; no IOMMU, VM, or sandbox boundary is bypassed.\nC:H - A torn descriptor makes the engine read from the previous chunk\u0027s SAR while writing to the new DAR, and a not-yet-landed LLP terminator lets it walk past the LL region and follow arbitrary BAR contents as descriptors, so effectively arbitrary host memory can be sourced and shipped to the remote endpoint or into a buffer the attacker reads back.\nI:H - The same stale or run-away descriptors give the PCIe engine a write with attacker-influenceable destination and length into host kernel-mapped memory \u2014 a memory-corruption write primitive, not merely wrong data in the intended buffer.\nA:H - DMA into unintended kernel memory reliably produces corruption and oops/panic, and the malformed descriptor walk also raises linked-list errors and abort interrupts that stall the channel and hang clients waiting on completion."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:38.896Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba"
        }
      ],
      "title": "dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27408",
    "datePublished": "2024-05-17T11:50:36.208Z",
    "dateReserved": "2024-02-25T13:47:42.682Z",
    "dateUpdated": "2026-08-05T11:29:38.896Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27408",
      "date": "2026-08-05",
      "epss": "0.00191",
      "percentile": "0.08926"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup\\n\\nThe Linked list element and pointer are not stored in the same memory as\\nthe eDMA controller register. If the doorbell register is toggled before\\nthe full write of the linked list a race condition error will occur.\\nIn remote setup we can only use a readl to the memory to assure the full\\nwrite has occurred.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: dmaengine: dw-edma: eDMA: A\\u00f1adida lectura sincronizada antes de iniciar la transferencia DMA en la configuraci\\u00f3n remota. El elemento de la lista vinculada y el puntero no se almacenan en la misma memoria que el registro del controlador eDMA. Si el registro del timbre se activa antes de la escritura completa de la lista vinculada, se producir\\u00e1 un error de condici\\u00f3n de ejecuci\\u00f3n. En la configuraci\\u00f3n remota, solo podemos usar una lectura en la memoria para asegurarnos de que se haya producido la escritura completa.\"}]",
      "id": "CVE-2024-27408",
      "lastModified": "2024-11-21T09:04:33.527",
      "published": "2024-05-17T12:15:11.223",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:02:52.000Z",
      "cve": "CVE-2024-27408",
      "id": "msrc_CVE-2024-27408",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-27408.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27408\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T12:15:11.223\",\"lastModified\":\"2026-08-04T11:17:47.107\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup\\n\\nThe Linked list element and pointer are not stored in the same memory as\\nthe eDMA controller register. If the doorbell register is toggled before\\nthe full write of the linked list a race condition error will occur.\\nIn remote setup we can only use a readl to the memory to assure the full\\nwrite has occurred.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: dmaengine: dw-edma: eDMA: A\u00f1adida lectura sincronizada antes de iniciar la transferencia DMA en la configuraci\u00f3n remota. El elemento de la lista vinculada y el puntero no se almacenan en la misma memoria que el registro del controlador eDMA. Si el registro del timbre se activa antes de la escritura completa de la lista vinculada, se producir\u00e1 un error de condici\u00f3n de ejecuci\u00f3n. En la configuraci\u00f3n remota, solo podemos usar una lectura en la memoria para asegurarnos de que se haya producido la escritura completa.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/dma/dw-edma/dw-edma-v0-core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7e4b8a4fbe2cecab0959e862604803d063f50029\",\"lessThan\":\"d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7e4b8a4fbe2cecab0959e862604803d063f50029\",\"lessThan\":\"f396b4df27cfe01a99f4b41f584c49e56477be3a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7e4b8a4fbe2cecab0959e862604803d063f50029\",\"lessThan\":\"bbcc1c83f343e580c3aa1f2a8593343bf7b55bba\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/dma/dw-edma/dw-edma-v0-core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.21\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.9\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-21T16:00:32.783313Z\",\"id\":\"CVE-2024-27408\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.3\",\"versionEndExcluding\":\"6.6.21\",\"matchCriteriaId\":\"3220B3B1-12D7-47E1-8AF9-CBF0B6529FE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.9\",\"matchCriteriaId\":\"1C538467-EDA0-4A9A-82EB-2925DE9FF827\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:07:59+00:00",
      "cve": "CVE-2024-27408",
      "id": "CVE-2024-27408",
      "initial_release_date": "2024-05-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27408.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:52:58Z",
      "cve": "CVE-2024-27408",
      "id": "CVE-2024-27408",
      "initial_release_date": "2024-05-18T02:46:13Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "312",
      "product_status:recommended": "358",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-27408",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-27408.json",
      "version": "80"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:34:52.272Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27408\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-21T16:00:32.783313Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.225Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable sequence is reached only through the local dmaengine client API (`dma_async_issue_pending()` \\u2192 `dw_edma_device_issue_pending()` \\u2192 `dw_edma_v0_core_start()`), i.e. via a device node or in-kernel client on the host driving the remote eDMA. There is no network- or packet-facing path into drivers/dma/dw-edma/.\\nAC:L - An attacker able to submit transfers can repeat them indefinitely at no cost and can widen the window at will by building large scatter-gather lists, since every chunk re-writes the LL and rings the doorbell again \\u2014 and per the commit, on affected remote setups the unordered doorbell simply races the LL writes rather than requiring an unusual condition.\\nPR:L - No capability check exists on the path \\u2014 the dmaengine core imposes none, so an unprivileged local account with ordinary access to a client device node backed by these eDMA channels is sufficient to issue the transfers that ring the doorbell.\\nUI:N - The attacker drives the entire submit/complete cycle on its own; no action by another user or administrator is needed, and an already-bound dw-edma-pcie device is system configuration rather than victim interaction.\\nS:U - The corrupted transfers act on host memory already within the DMA mapping the kernel authorized for this device, all under the same kernel security authority; no IOMMU, VM, or sandbox boundary is bypassed.\\nC:H - A torn descriptor makes the engine read from the previous chunk\u0027s SAR while writing to the new DAR, and a not-yet-landed LLP terminator lets it walk past the LL region and follow arbitrary BAR contents as descriptors, so effectively arbitrary host memory can be sourced and shipped to the remote endpoint or into a buffer the attacker reads back.\\nI:H - The same stale or run-away descriptors give the PCIe engine a write with attacker-influenceable destination and length into host kernel-mapped memory \\u2014 a memory-corruption write primitive, not merely wrong data in the intended buffer.\\nA:H - DMA into unintended kernel memory reliably produces corruption and oops/panic, and the malformed descriptor walk also raises linked-list errors and abort interrupts that stall the channel and hang clients waiting on completion.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7e4b8a4fbe2cecab0959e862604803d063f50029\", \"lessThan\": \"d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7e4b8a4fbe2cecab0959e862604803d063f50029\", \"lessThan\": \"f396b4df27cfe01a99f4b41f584c49e56477be3a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7e4b8a4fbe2cecab0959e862604803d063f50029\", \"lessThan\": \"bbcc1c83f343e580c3aa1f2a8593343bf7b55bba\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/dma/dw-edma/dw-edma-v0-core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.21\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/dma/dw-edma/dw-edma-v0-core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3\"}, {\"url\": \"https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a\"}, {\"url\": \"https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup\\n\\nThe Linked list element and pointer are not stored in the same memory as\\nthe eDMA controller register. If the doorbell register is toggled before\\nthe full write of the linked list a race condition error will occur.\\nIn remote setup we can only use a readl to the memory to assure the full\\nwrite has occurred.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.21\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.9\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:29:38.896Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27408\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:29:38.896Z\", \"dateReserved\": \"2024-02-25T13:47:42.682Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T11:50:36.208Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.