CVE-2024-53058 (GCVE-0-2024-53058)

Vulnerability from cvelistv5 – Published: 2024-11-19 17:19 – Updated: 2026-08-05 11:43
VLAI
Title
net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data
Summary
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data In case the non-paged data of a SKB carries protocol header and protocol payload to be transmitted on a certain platform that the DMA AXI address width is configured to 40-bit/48-bit, or the size of the non-paged data is bigger than TSO_MAX_BUFF_SIZE on a certain platform that the DMA AXI address width is configured to 32-bit, then this SKB requires at least two DMA transmit descriptors to serve it. For example, three descriptors are allocated to split one DMA buffer mapped from one piece of non-paged data: dma_desc[N + 0], dma_desc[N + 1], dma_desc[N + 2]. Then three elements of tx_q->tx_skbuff_dma[] will be allocated to hold extra information to be reused in stmmac_tx_clean(): tx_q->tx_skbuff_dma[N + 0], tx_q->tx_skbuff_dma[N + 1], tx_q->tx_skbuff_dma[N + 2]. Now we focus on tx_q->tx_skbuff_dma[entry].buf, which is the DMA buffer address returned by DMA mapping call. stmmac_tx_clean() will try to unmap the DMA buffer _ONLY_IF_ tx_q->tx_skbuff_dma[entry].buf is a valid buffer address. The expected behavior that saves DMA buffer address of this non-paged data to tx_q->tx_skbuff_dma[entry].buf is: tx_q->tx_skbuff_dma[N + 0].buf = NULL; tx_q->tx_skbuff_dma[N + 1].buf = NULL; tx_q->tx_skbuff_dma[N + 2].buf = dma_map_single(); Unfortunately, the current code misbehaves like this: tx_q->tx_skbuff_dma[N + 0].buf = dma_map_single(); tx_q->tx_skbuff_dma[N + 1].buf = NULL; tx_q->tx_skbuff_dma[N + 2].buf = NULL; On the stmmac_tx_clean() side, when dma_desc[N + 0] is closed by the DMA engine, tx_q->tx_skbuff_dma[N + 0].buf is a valid buffer address obviously, then the DMA buffer will be unmapped immediately. There may be a rare case that the DMA engine does not finish the pending dma_desc[N + 1], dma_desc[N + 2] yet. Now things will go horribly wrong, DMA is going to access a unmapped/unreferenced memory region, corrupted data will be transmited or iommu fault will be triggered :( In contrast, the for-loop that maps SKB fragments behaves perfectly as expected, and that is how the driver should do for both non-paged data and paged frags actually. This patch corrects DMA map/unmap sequences by fixing the array index for tx_q->tx_skbuff_dma[entry].buf when assigning DMA buffer address. Tested and verified on DWXGMAC CORE 3.20a
Severity
9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:12 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f748be531d7012c456b97f66091d86b3675c5fef , < ece593fc9c00741b682869d3f3dc584d37b7c9df (git)
Affected: f748be531d7012c456b97f66091d86b3675c5fef , < a3ff23f7c3f0e13f718900803e090fd3997d6bc9 (git)
Affected: f748be531d7012c456b97f66091d86b3675c5fef , < 07c9c26e37542486e34d767505e842f48f29c3f6 (git)
Affected: f748be531d7012c456b97f66091d86b3675c5fef , < 58d23d835eb498336716cca55b5714191a309286 (git)
Affected: f748be531d7012c456b97f66091d86b3675c5fef , < 66600fac7a984dea4ae095411f644770b2561ede (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 5.15.171 , ≤ 5.15.* (semver)
Unaffected: 6.1.116 , ≤ 6.1.* (semver)
Unaffected: 6.6.60 , ≤ 6.6.* (semver)
Unaffected: 6.11.7 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53058",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:12:56.492428Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:17.845Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:28:51.972Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ece593fc9c00741b682869d3f3dc584d37b7c9df",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            },
            {
              "lessThan": "a3ff23f7c3f0e13f718900803e090fd3997d6bc9",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            },
            {
              "lessThan": "07c9c26e37542486e34d767505e842f48f29c3f6",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            },
            {
              "lessThan": "58d23d835eb498336716cca55b5714191a309286",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            },
            {
              "lessThan": "66600fac7a984dea4ae095411f644770b2561ede",
              "status": "affected",
              "version": "f748be531d7012c456b97f66091d86b3675c5fef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.171",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.116",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.171",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.116",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.60",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.7",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data\n\nIn case the non-paged data of a SKB carries protocol header and protocol\npayload to be transmitted on a certain platform that the DMA AXI address\nwidth is configured to 40-bit/48-bit, or the size of the non-paged data\nis bigger than TSO_MAX_BUFF_SIZE on a certain platform that the DMA AXI\naddress width is configured to 32-bit, then this SKB requires at least\ntwo DMA transmit descriptors to serve it.\n\nFor example, three descriptors are allocated to split one DMA buffer\nmapped from one piece of non-paged data:\n    dma_desc[N + 0],\n    dma_desc[N + 1],\n    dma_desc[N + 2].\nThen three elements of tx_q-\u003etx_skbuff_dma[] will be allocated to hold\nextra information to be reused in stmmac_tx_clean():\n    tx_q-\u003etx_skbuff_dma[N + 0],\n    tx_q-\u003etx_skbuff_dma[N + 1],\n    tx_q-\u003etx_skbuff_dma[N + 2].\nNow we focus on tx_q-\u003etx_skbuff_dma[entry].buf, which is the DMA buffer\naddress returned by DMA mapping call. stmmac_tx_clean() will try to\nunmap the DMA buffer _ONLY_IF_ tx_q-\u003etx_skbuff_dma[entry].buf\nis a valid buffer address.\n\nThe expected behavior that saves DMA buffer address of this non-paged\ndata to tx_q-\u003etx_skbuff_dma[entry].buf is:\n    tx_q-\u003etx_skbuff_dma[N + 0].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 1].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 2].buf = dma_map_single();\nUnfortunately, the current code misbehaves like this:\n    tx_q-\u003etx_skbuff_dma[N + 0].buf = dma_map_single();\n    tx_q-\u003etx_skbuff_dma[N + 1].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 2].buf = NULL;\n\nOn the stmmac_tx_clean() side, when dma_desc[N + 0] is closed by the\nDMA engine, tx_q-\u003etx_skbuff_dma[N + 0].buf is a valid buffer address\nobviously, then the DMA buffer will be unmapped immediately.\nThere may be a rare case that the DMA engine does not finish the\npending dma_desc[N + 1], dma_desc[N + 2] yet. Now things will go\nhorribly wrong, DMA is going to access a unmapped/unreferenced memory\nregion, corrupted data will be transmited or iommu fault will be\ntriggered :(\n\nIn contrast, the for-loop that maps SKB fragments behaves perfectly\nas expected, and that is how the driver should do for both non-paged\ndata and paged frags actually.\n\nThis patch corrects DMA map/unmap sequences by fixing the array index\nfor tx_q-\u003etx_skbuff_dma[entry].buf when assigning DMA buffer address.\n\nTested and verified on DWXGMAC CORE 3.20a"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the stmmac TSO transmit path, driven directly by remote traffic \u2014 an unauthenticated peer pulling data from any service on the device, or forwarded/GRO-coalesced streams re-segmented on egress by an stmmac-based gateway, arm the bug, and the resulting corrupted frames (carrying recycled kernel memory) are delivered to that remote peer. The attacker set is not bounded to the local LAN or local machine.\nAC:L - On the common 40/48-bit AXI platforms the mismatched map/unmap occurs on essentially every TSO frame whose linear head carries payload, in the default configuration, and the attacker can drive that path at line rate without limit, so the DMA-completion window is hit repeatedly rather than requiring a skilled one-shot race win.\nPR:N - No authentication or privilege is needed \u2014 merely causing the host to transmit large TCP/UDP-GSO data (a plain TCP connection to any listening service, or traffic routed through the device) reaches the code; locally, an ordinary unprivileged socket send suffices.\nUI:N - Triggering requires only network traffic to or through the affected interface; no action by any local user or administrator is involved.\nS:U - The stale IOVA is recycled within the same device\u0027s own DMA domain and the impacted resources belong to the kernel that owns the driver, so no security authority boundary (VM, IOMMU domain, sandbox) is crossed.\nC:H - When the unmapped IOVA or SWIOTLB slot is reused before the engine finishes, the MAC reads whatever buffer now occupies it \u2014 other sockets\u0027 packet data, page-pool/page-frag pages, or another device\u0027s bounced I/O \u2014 and transmits it on the wire with valid hardware checksums, handing an unbounded amount of kernel memory straight to the remote peer.\nI:L - Outbound frame contents are silently replaced with unrelated memory and re-checksummed by hardware, so peers accept corrupted data undetected, but the device only performs DMA reads \u2014 there is no kernel write primitive and the attacker cannot control what gets corrupted.\nA:H - DMA to a torn-down mapping raises IOMMU translation faults and aborted transactions, producing TX errors, log floods, TX-watchdog-driven device resets and link loss, and on SoCs that escalate the resulting bus error an unrecoverable external abort."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:21.929Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ece593fc9c00741b682869d3f3dc584d37b7c9df"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3ff23f7c3f0e13f718900803e090fd3997d6bc9"
        },
        {
          "url": "https://git.kernel.org/stable/c/07c9c26e37542486e34d767505e842f48f29c3f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/58d23d835eb498336716cca55b5714191a309286"
        },
        {
          "url": "https://git.kernel.org/stable/c/66600fac7a984dea4ae095411f644770b2561ede"
        }
      ],
      "title": "net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53058",
    "datePublished": "2024-11-19T17:19:40.912Z",
    "dateReserved": "2024-11-19T17:17:24.974Z",
    "dateUpdated": "2026-08-05T11:43:21.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53058",
      "date": "2026-10-06",
      "epss": "0.00607",
      "percentile": "0.47316"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F7B2EF6A-A80D-4A30-B1E9-7DBA47DFA518",
                  "versionEndExcluding": "5.15.171",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "43EFDC15-E4D4-4F1E-B70D-62F0854BFDF3",
                  "versionEndExcluding": "6.1.116",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "75088E5E-2400-4D20-915F-7A65C55D9CCD",
                  "versionEndExcluding": "6.6.60",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E96F53A4-5E87-4A70-BD9A-BC327828D57F",
                  "versionEndExcluding": "6.11.7",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*",
                  "matchCriteriaId": "24DBE6C7-2AAE-4818-AED2-E131F153D2FA",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data\n\nIn case the non-paged data of a SKB carries protocol header and protocol\npayload to be transmitted on a certain platform that the DMA AXI address\nwidth is configured to 40-bit/48-bit, or the size of the non-paged data\nis bigger than TSO_MAX_BUFF_SIZE on a certain platform that the DMA AXI\naddress width is configured to 32-bit, then this SKB requires at least\ntwo DMA transmit descriptors to serve it.\n\nFor example, three descriptors are allocated to split one DMA buffer\nmapped from one piece of non-paged data:\n    dma_desc[N + 0],\n    dma_desc[N + 1],\n    dma_desc[N + 2].\nThen three elements of tx_q-\u003etx_skbuff_dma[] will be allocated to hold\nextra information to be reused in stmmac_tx_clean():\n    tx_q-\u003etx_skbuff_dma[N + 0],\n    tx_q-\u003etx_skbuff_dma[N + 1],\n    tx_q-\u003etx_skbuff_dma[N + 2].\nNow we focus on tx_q-\u003etx_skbuff_dma[entry].buf, which is the DMA buffer\naddress returned by DMA mapping call. stmmac_tx_clean() will try to\nunmap the DMA buffer _ONLY_IF_ tx_q-\u003etx_skbuff_dma[entry].buf\nis a valid buffer address.\n\nThe expected behavior that saves DMA buffer address of this non-paged\ndata to tx_q-\u003etx_skbuff_dma[entry].buf is:\n    tx_q-\u003etx_skbuff_dma[N + 0].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 1].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 2].buf = dma_map_single();\nUnfortunately, the current code misbehaves like this:\n    tx_q-\u003etx_skbuff_dma[N + 0].buf = dma_map_single();\n    tx_q-\u003etx_skbuff_dma[N + 1].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 2].buf = NULL;\n\nOn the stmmac_tx_clean() side, when dma_desc[N + 0] is closed by the\nDMA engine, tx_q-\u003etx_skbuff_dma[N + 0].buf is a valid buffer address\nobviously, then the DMA buffer will be unmapped immediately.\nThere may be a rare case that the DMA engine does not finish the\npending dma_desc[N + 1], dma_desc[N + 2] yet. Now things will go\nhorribly wrong, DMA is going to access a unmapped/unreferenced memory\nregion, corrupted data will be transmited or iommu fault will be\ntriggered :(\n\nIn contrast, the for-loop that maps SKB fragments behaves perfectly\nas expected, and that is how the driver should do for both non-paged\ndata and paged frags actually.\n\nThis patch corrects DMA map/unmap sequences by fixing the array index\nfor tx_q-\u003etx_skbuff_dma[entry].buf when assigning DMA buffer address.\n\nTested and verified on DWXGMAC CORE 3.20a"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: stmmac: TSO: Fix DMA map/unmap no balanceado para datos SKB no paginados En caso de que los datos no paginados de un SKB lleven encabezado de protocolo y payload de protocolo para ser transmitidos en una determinada plataforma que el ancho de direcci\u00f3n DMA AXI est\u00e1 configurado a 40 bits/48 bits, o el tama\u00f1o de los datos no paginados es mayor que TSO_MAX_BUFF_SIZE en una determinada plataforma que el ancho de direcci\u00f3n DMA AXI est\u00e1 configurado a 32 bits, entonces este SKB requiere al menos dos descriptores de transmisi\u00f3n DMA para servirlo. Por ejemplo, se asignan tres descriptores para dividir un buffer DMA mapeado a partir de una pieza de datos no paginados: dma_desc[N + 0], dma_desc[N + 1], dma_desc[N + 2]. Luego, se asignar\u00e1n tres elementos de tx_q-\u0026gt;tx_skbuff_dma[] para almacenar informaci\u00f3n adicional que se reutilizar\u00e1 en stmmac_tx_clean(): tx_q-\u0026gt;tx_skbuff_dma[N + 0], tx_q-\u0026gt;tx_skbuff_dma[N + 1], tx_q-\u0026gt;tx_skbuff_dma[N + 2]. Ahora nos centramos en tx_q-\u0026gt;tx_skbuff_dma[entry].buf, que es la direcci\u00f3n del b\u00fafer DMA devuelta por la llamada de mapeo DMA. stmmac_tx_clean() intentar\u00e1 desasignar el b\u00fafer DMA _SOLO_SI_ tx_q-\u0026gt;tx_skbuff_dma[entry].buf es una direcci\u00f3n de b\u00fafer v\u00e1lida. El comportamiento esperado que guarda la direcci\u00f3n del buffer DMA de estos datos no paginados en tx_q-\u0026gt;tx_skbuff_dma[entrada].buf es: tx_q-\u0026gt;tx_skbuff_dma[N + 0].buf = NULL; tx_q-\u0026gt;tx_skbuff_dma[N + 1].buf = NULL; tx_q-\u0026gt;tx_skbuff_dma[N + 2].buf = dma_map_single(); Desafortunadamente, el c\u00f3digo actual se comporta mal de esta manera: tx_q-\u0026gt;tx_skbuff_dma[N + 0].buf = dma_map_single(); tx_q-\u0026gt;tx_skbuff_dma[N + 1].buf = NULL; tx_q-\u0026gt;tx_skbuff_dma[N + 2].buf = NULL; En el lado stmmac_tx_clean(), cuando el motor DMA cierra dma_desc[N + 0], tx_q-\u0026gt;tx_skbuff_dma[N + 0].buf es obviamente una direcci\u00f3n de b\u00fafer v\u00e1lida, entonces el b\u00fafer DMA se desasignar\u00e1 inmediatamente. Puede haber un caso poco com\u00fan en el que el motor DMA no finalice a\u00fan los dma_desc[N + 1], dma_desc[N + 2] pendientes. Ahora las cosas saldr\u00e1n terriblemente mal, DMA acceder\u00e1 a una regi\u00f3n de memoria no mapeada/no referenciada, se transmitir\u00e1n datos corruptos o se activar\u00e1 un error de iommu :( Por el contrario, el bucle for que mapea fragmentos SKB se comporta perfectamente como se espera, y as\u00ed es como el controlador deber\u00eda funcionar tanto para datos no paginados como para fragmentos paginados en realidad. Este parche corrige las secuencias de mapeo/desasignamiento de DMA al arreglar el \u00edndice de matriz para tx_q-\u0026gt;tx_skbuff_dma[entry].buf al asignar la direcci\u00f3n del b\u00fafer de DMA. Probado y verificado en DWXGMAC CORE 3.20a"
        }
      ],
      "id": "CVE-2024-53058",
      "lastModified": "2024-11-22T17:53:32.500",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-11-19T18:15:25.767",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/07c9c26e37542486e34d767505e842f48f29c3f6"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/58d23d835eb498336716cca55b5714191a309286"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/66600fac7a984dea4ae095411f644770b2561ede"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/a3ff23f7c3f0e13f718900803e090fd3997d6bc9"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/ece593fc9c00741b682869d3f3dc584d37b7c9df"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-noinfo"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-19T01:21:09.000Z",
      "cve": "CVE-2024-53058",
      "id": "msrc_CVE-2024-53058",
      "initial_release_date": "2024-11-02T00:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-53058.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ece593fc9c00741b682869d3f3dc584d37b7c9df",
                    "status": "affected",
                    "version": "f748be531d7012c456b97f66091d86b3675c5fef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a3ff23f7c3f0e13f718900803e090fd3997d6bc9",
                    "status": "affected",
                    "version": "f748be531d7012c456b97f66091d86b3675c5fef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "07c9c26e37542486e34d767505e842f48f29c3f6",
                    "status": "affected",
                    "version": "f748be531d7012c456b97f66091d86b3675c5fef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "58d23d835eb498336716cca55b5714191a309286",
                    "status": "affected",
                    "version": "f748be531d7012c456b97f66091d86b3675c5fef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "66600fac7a984dea4ae095411f644770b2561ede",
                    "status": "affected",
                    "version": "f748be531d7012c456b97f66091d86b3675c5fef",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.7"
                  },
                  {
                    "lessThan": "4.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.171",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.116",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.60",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F7B2EF6A-A80D-4A30-B1E9-7DBA47DFA518",
                    "versionEndExcluding": "5.15.171",
                    "versionStartIncluding": "4.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "43EFDC15-E4D4-4F1E-B70D-62F0854BFDF3",
                    "versionEndExcluding": "6.1.116",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "75088E5E-2400-4D20-915F-7A65C55D9CCD",
                    "versionEndExcluding": "6.6.60",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E96F53A4-5E87-4A70-BD9A-BC327828D57F",
                    "versionEndExcluding": "6.11.7",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "24DBE6C7-2AAE-4818-AED2-E131F153D2FA",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data\n\nIn case the non-paged data of a SKB carries protocol header and protocol\npayload to be transmitted on a certain platform that the DMA AXI address\nwidth is configured to 40-bit/48-bit, or the size of the non-paged data\nis bigger than TSO_MAX_BUFF_SIZE on a certain platform that the DMA AXI\naddress width is configured to 32-bit, then this SKB requires at least\ntwo DMA transmit descriptors to serve it.\n\nFor example, three descriptors are allocated to split one DMA buffer\nmapped from one piece of non-paged data:\n    dma_desc[N + 0],\n    dma_desc[N + 1],\n    dma_desc[N + 2].\nThen three elements of tx_q-\u003etx_skbuff_dma[] will be allocated to hold\nextra information to be reused in stmmac_tx_clean():\n    tx_q-\u003etx_skbuff_dma[N + 0],\n    tx_q-\u003etx_skbuff_dma[N + 1],\n    tx_q-\u003etx_skbuff_dma[N + 2].\nNow we focus on tx_q-\u003etx_skbuff_dma[entry].buf, which is the DMA buffer\naddress returned by DMA mapping call. stmmac_tx_clean() will try to\nunmap the DMA buffer _ONLY_IF_ tx_q-\u003etx_skbuff_dma[entry].buf\nis a valid buffer address.\n\nThe expected behavior that saves DMA buffer address of this non-paged\ndata to tx_q-\u003etx_skbuff_dma[entry].buf is:\n    tx_q-\u003etx_skbuff_dma[N + 0].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 1].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 2].buf = dma_map_single();\nUnfortunately, the current code misbehaves like this:\n    tx_q-\u003etx_skbuff_dma[N + 0].buf = dma_map_single();\n    tx_q-\u003etx_skbuff_dma[N + 1].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 2].buf = NULL;\n\nOn the stmmac_tx_clean() side, when dma_desc[N + 0] is closed by the\nDMA engine, tx_q-\u003etx_skbuff_dma[N + 0].buf is a valid buffer address\nobviously, then the DMA buffer will be unmapped immediately.\nThere may be a rare case that the DMA engine does not finish the\npending dma_desc[N + 1], dma_desc[N + 2] yet. Now things will go\nhorribly wrong, DMA is going to access a unmapped/unreferenced memory\nregion, corrupted data will be transmited or iommu fault will be\ntriggered :(\n\nIn contrast, the for-loop that maps SKB fragments behaves perfectly\nas expected, and that is how the driver should do for both non-paged\ndata and paged frags actually.\n\nThis patch corrects DMA map/unmap sequences by fixing the array index\nfor tx_q-\u003etx_skbuff_dma[entry].buf when assigning DMA buffer address.\n\nTested and verified on DWXGMAC CORE 3.20a"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: stmmac: TSO: Fix DMA map/unmap no balanceado para datos SKB no paginados En caso de que los datos no paginados de un SKB lleven encabezado de protocolo y payload de protocolo para ser transmitidos en una determinada plataforma que el ancho de direcci\u00f3n DMA AXI est\u00e1 configurado a 40 bits/48 bits, o el tama\u00f1o de los datos no paginados es mayor que TSO_MAX_BUFF_SIZE en una determinada plataforma que el ancho de direcci\u00f3n DMA AXI est\u00e1 configurado a 32 bits, entonces este SKB requiere al menos dos descriptores de transmisi\u00f3n DMA para servirlo. Por ejemplo, se asignan tres descriptores para dividir un buffer DMA mapeado a partir de una pieza de datos no paginados: dma_desc[N + 0], dma_desc[N + 1], dma_desc[N + 2]. Luego, se asignar\u00e1n tres elementos de tx_q-\u0026gt;tx_skbuff_dma[] para almacenar informaci\u00f3n adicional que se reutilizar\u00e1 en stmmac_tx_clean(): tx_q-\u0026gt;tx_skbuff_dma[N + 0], tx_q-\u0026gt;tx_skbuff_dma[N + 1], tx_q-\u0026gt;tx_skbuff_dma[N + 2]. Ahora nos centramos en tx_q-\u0026gt;tx_skbuff_dma[entry].buf, que es la direcci\u00f3n del b\u00fafer DMA devuelta por la llamada de mapeo DMA. stmmac_tx_clean() intentar\u00e1 desasignar el b\u00fafer DMA _SOLO_SI_ tx_q-\u0026gt;tx_skbuff_dma[entry].buf es una direcci\u00f3n de b\u00fafer v\u00e1lida. El comportamiento esperado que guarda la direcci\u00f3n del buffer DMA de estos datos no paginados en tx_q-\u0026gt;tx_skbuff_dma[entrada].buf es: tx_q-\u0026gt;tx_skbuff_dma[N + 0].buf = NULL; tx_q-\u0026gt;tx_skbuff_dma[N + 1].buf = NULL; tx_q-\u0026gt;tx_skbuff_dma[N + 2].buf = dma_map_single(); Desafortunadamente, el c\u00f3digo actual se comporta mal de esta manera: tx_q-\u0026gt;tx_skbuff_dma[N + 0].buf = dma_map_single(); tx_q-\u0026gt;tx_skbuff_dma[N + 1].buf = NULL; tx_q-\u0026gt;tx_skbuff_dma[N + 2].buf = NULL; En el lado stmmac_tx_clean(), cuando el motor DMA cierra dma_desc[N + 0], tx_q-\u0026gt;tx_skbuff_dma[N + 0].buf es obviamente una direcci\u00f3n de b\u00fafer v\u00e1lida, entonces el b\u00fafer DMA se desasignar\u00e1 inmediatamente. Puede haber un caso poco com\u00fan en el que el motor DMA no finalice a\u00fan los dma_desc[N + 1], dma_desc[N + 2] pendientes. Ahora las cosas saldr\u00e1n terriblemente mal, DMA acceder\u00e1 a una regi\u00f3n de memoria no mapeada/no referenciada, se transmitir\u00e1n datos corruptos o se activar\u00e1 un error de iommu :( Por el contrario, el bucle for que mapea fragmentos SKB se comporta perfectamente como se espera, y as\u00ed es como el controlador deber\u00eda funcionar tanto para datos no paginados como para fragmentos paginados en realidad. Este parche corrige las secuencias de mapeo/desasignamiento de DMA al arreglar el \u00edndice de matriz para tx_q-\u0026gt;tx_skbuff_dma[entry].buf al asignar la direcci\u00f3n del b\u00fafer de DMA. Probado y verificado en DWXGMAC CORE 3.20a"
          }
        ],
        "id": "CVE-2024-53058",
        "lastModified": "2026-08-04T11:21:45.993",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-53058",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:12:56.492428Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-11-19T18:15:25.767",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/07c9c26e37542486e34d767505e842f48f29c3f6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/58d23d835eb498336716cca55b5714191a309286"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/66600fac7a984dea4ae095411f644770b2561ede"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a3ff23f7c3f0e13f718900803e090fd3997d6bc9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ece593fc9c00741b682869d3f3dc584d37b7c9df"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:17:01+00:00",
      "cve": "CVE-2024-53058",
      "id": "CVE-2024-53058",
      "initial_release_date": "2024-11-19T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53058.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-30T15:38:30Z",
      "cve": "CVE-2024-53058",
      "id": "CVE-2024-53058",
      "initial_release_date": "2024-11-20T03:49:03Z",
      "product_status:known_affected": "619",
      "product_status:known_not_affected": "46",
      "product_status:recommended": "575",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-53058",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-53058.json",
      "version": "58"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T22:28:51.972Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-53058",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T20:12:56.492428Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "description": "CWE-noinfo Not enough information",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T15:29:37.654Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "ece593fc9c00741b682869d3f3dc584d37b7c9df",
                  "status": "affected",
                  "version": "f748be531d7012c456b97f66091d86b3675c5fef",
                  "versionType": "git"
                },
                {
                  "lessThan": "a3ff23f7c3f0e13f718900803e090fd3997d6bc9",
                  "status": "affected",
                  "version": "f748be531d7012c456b97f66091d86b3675c5fef",
                  "versionType": "git"
                },
                {
                  "lessThan": "07c9c26e37542486e34d767505e842f48f29c3f6",
                  "status": "affected",
                  "version": "f748be531d7012c456b97f66091d86b3675c5fef",
                  "versionType": "git"
                },
                {
                  "lessThan": "58d23d835eb498336716cca55b5714191a309286",
                  "status": "affected",
                  "version": "f748be531d7012c456b97f66091d86b3675c5fef",
                  "versionType": "git"
                },
                {
                  "lessThan": "66600fac7a984dea4ae095411f644770b2561ede",
                  "status": "affected",
                  "version": "f748be531d7012c456b97f66091d86b3675c5fef",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.7"
                },
                {
                  "lessThan": "4.7",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.171",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.116",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.60",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.12",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.171",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.116",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.60",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.7",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data\n\nIn case the non-paged data of a SKB carries protocol header and protocol\npayload to be transmitted on a certain platform that the DMA AXI address\nwidth is configured to 40-bit/48-bit, or the size of the non-paged data\nis bigger than TSO_MAX_BUFF_SIZE on a certain platform that the DMA AXI\naddress width is configured to 32-bit, then this SKB requires at least\ntwo DMA transmit descriptors to serve it.\n\nFor example, three descriptors are allocated to split one DMA buffer\nmapped from one piece of non-paged data:\n    dma_desc[N + 0],\n    dma_desc[N + 1],\n    dma_desc[N + 2].\nThen three elements of tx_q-\u003etx_skbuff_dma[] will be allocated to hold\nextra information to be reused in stmmac_tx_clean():\n    tx_q-\u003etx_skbuff_dma[N + 0],\n    tx_q-\u003etx_skbuff_dma[N + 1],\n    tx_q-\u003etx_skbuff_dma[N + 2].\nNow we focus on tx_q-\u003etx_skbuff_dma[entry].buf, which is the DMA buffer\naddress returned by DMA mapping call. stmmac_tx_clean() will try to\nunmap the DMA buffer _ONLY_IF_ tx_q-\u003etx_skbuff_dma[entry].buf\nis a valid buffer address.\n\nThe expected behavior that saves DMA buffer address of this non-paged\ndata to tx_q-\u003etx_skbuff_dma[entry].buf is:\n    tx_q-\u003etx_skbuff_dma[N + 0].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 1].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 2].buf = dma_map_single();\nUnfortunately, the current code misbehaves like this:\n    tx_q-\u003etx_skbuff_dma[N + 0].buf = dma_map_single();\n    tx_q-\u003etx_skbuff_dma[N + 1].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 2].buf = NULL;\n\nOn the stmmac_tx_clean() side, when dma_desc[N + 0] is closed by the\nDMA engine, tx_q-\u003etx_skbuff_dma[N + 0].buf is a valid buffer address\nobviously, then the DMA buffer will be unmapped immediately.\nThere may be a rare case that the DMA engine does not finish the\npending dma_desc[N + 1], dma_desc[N + 2] yet. Now things will go\nhorribly wrong, DMA is going to access a unmapped/unreferenced memory\nregion, corrupted data will be transmited or iommu fault will be\ntriggered :(\n\nIn contrast, the for-loop that maps SKB fragments behaves perfectly\nas expected, and that is how the driver should do for both non-paged\ndata and paged frags actually.\n\nThis patch corrects DMA map/unmap sequences by fixing the array index\nfor tx_q-\u003etx_skbuff_dma[entry].buf when assigning DMA buffer address.\n\nTested and verified on DWXGMAC CORE 3.20a"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The vulnerable code is the stmmac TSO transmit path, driven directly by remote traffic \u2014 an unauthenticated peer pulling data from any service on the device, or forwarded/GRO-coalesced streams re-segmented on egress by an stmmac-based gateway, arm the bug, and the resulting corrupted frames (carrying recycled kernel memory) are delivered to that remote peer. The attacker set is not bounded to the local LAN or local machine.\nAC:L - On the common 40/48-bit AXI platforms the mismatched map/unmap occurs on essentially every TSO frame whose linear head carries payload, in the default configuration, and the attacker can drive that path at line rate without limit, so the DMA-completion window is hit repeatedly rather than requiring a skilled one-shot race win.\nPR:N - No authentication or privilege is needed \u2014 merely causing the host to transmit large TCP/UDP-GSO data (a plain TCP connection to any listening service, or traffic routed through the device) reaches the code; locally, an ordinary unprivileged socket send suffices.\nUI:N - Triggering requires only network traffic to or through the affected interface; no action by any local user or administrator is involved.\nS:U - The stale IOVA is recycled within the same device\u0027s own DMA domain and the impacted resources belong to the kernel that owns the driver, so no security authority boundary (VM, IOMMU domain, sandbox) is crossed.\nC:H - When the unmapped IOVA or SWIOTLB slot is reused before the engine finishes, the MAC reads whatever buffer now occupies it \u2014 other sockets\u0027 packet data, page-pool/page-frag pages, or another device\u0027s bounced I/O \u2014 and transmits it on the wire with valid hardware checksums, handing an unbounded amount of kernel memory straight to the remote peer.\nI:L - Outbound frame contents are silently replaced with unrelated memory and re-checksummed by hardware, so peers accept corrupted data undetected, but the device only performs DMA reads \u2014 there is no kernel write primitive and the attacker cannot control what gets corrupted.\nA:H - DMA to a torn-down mapping raises IOMMU translation faults and aborted transactions, producing TX errors, log floods, TX-watchdog-driven device resets and link loss, and on SoCs that escalate the resulting bus error an unrecoverable external abort."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:43:21.929Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/ece593fc9c00741b682869d3f3dc584d37b7c9df"
            },
            {
              "url": "https://git.kernel.org/stable/c/a3ff23f7c3f0e13f718900803e090fd3997d6bc9"
            },
            {
              "url": "https://git.kernel.org/stable/c/07c9c26e37542486e34d767505e842f48f29c3f6"
            },
            {
              "url": "https://git.kernel.org/stable/c/58d23d835eb498336716cca55b5714191a309286"
            },
            {
              "url": "https://git.kernel.org/stable/c/66600fac7a984dea4ae095411f644770b2561ede"
            }
          ],
          "title": "net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-53058",
        "datePublished": "2024-11-19T17:19:40.912Z",
        "dateReserved": "2024-11-19T17:17:24.974Z",
        "dateUpdated": "2026-08-05T11:43:21.929Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.