cve-2024-27079
Vulnerability from cvelistv5
Published
2024-05-01 13:04
Modified
2024-08-02 00:27
Severity
Summary
iommu/vt-d: Fix NULL domain on device release
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/333fe86968482ca701c609af590003bcea450e8f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/81e921fd321614c2ad8ac333b041aae1da7a1c6d
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27079",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T17:45:27.745235Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:46:28.295Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:27:57.800Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/333fe86968482ca701c609af590003bcea450e8f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/81e921fd321614c2ad8ac333b041aae1da7a1c6d"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.c",
            "drivers/iommu/intel/pasid.c",
            "drivers/iommu/intel/pasid.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "333fe8696848",
              "status": "affected",
              "version": "586081d3f6b1",
              "versionType": "git"
            },
            {
              "lessThan": "81e921fd3216",
              "status": "affected",
              "version": "586081d3f6b1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.c",
            "drivers/iommu/intel/pasid.c",
            "drivers/iommu/intel/pasid.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix NULL domain on device release\n\nIn the kdump kernel, the IOMMU operates in deferred_attach mode. In this\nmode, info-\u003edomain may not yet be assigned by the time the release_device\nfunction is called. It leads to the following crash in the crash kernel:\n\n    BUG: kernel NULL pointer dereference, address: 000000000000003c\n    ...\n    RIP: 0010:do_raw_spin_lock+0xa/0xa0\n    ...\n    _raw_spin_lock_irqsave+0x1b/0x30\n    intel_iommu_release_device+0x96/0x170\n    iommu_deinit_device+0x39/0xf0\n    __iommu_group_remove_device+0xa0/0xd0\n    iommu_bus_notifier+0x55/0xb0\n    notifier_call_chain+0x5a/0xd0\n    blocking_notifier_call_chain+0x41/0x60\n    bus_notify+0x34/0x50\n    device_del+0x269/0x3d0\n    pci_remove_bus_device+0x77/0x100\n    p2sb_bar+0xae/0x1d0\n    ...\n    i801_probe+0x423/0x740\n\nUse the release_domain mechanism to fix it. The scalable mode context\nentry which is not part of release domain should be cleared in\nrelease_device()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:28:10.911Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/333fe86968482ca701c609af590003bcea450e8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/81e921fd321614c2ad8ac333b041aae1da7a1c6d"
        }
      ],
      "title": "iommu/vt-d: Fix NULL domain on device release",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27079",
    "datePublished": "2024-05-01T13:04:58.511Z",
    "dateReserved": "2024-02-19T14:20:24.217Z",
    "dateUpdated": "2024-08-02T00:27:57.800Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27079\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T13:15:51.443\",\"lastModified\":\"2024-05-01T19:50:25.633\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/vt-d: Fix NULL domain on device release\\n\\nIn the kdump kernel, the IOMMU operates in deferred_attach mode. In this\\nmode, info-\u003edomain may not yet be assigned by the time the release_device\\nfunction is called. It leads to the following crash in the crash kernel:\\n\\n    BUG: kernel NULL pointer dereference, address: 000000000000003c\\n    ...\\n    RIP: 0010:do_raw_spin_lock+0xa/0xa0\\n    ...\\n    _raw_spin_lock_irqsave+0x1b/0x30\\n    intel_iommu_release_device+0x96/0x170\\n    iommu_deinit_device+0x39/0xf0\\n    __iommu_group_remove_device+0xa0/0xd0\\n    iommu_bus_notifier+0x55/0xb0\\n    notifier_call_chain+0x5a/0xd0\\n    blocking_notifier_call_chain+0x41/0x60\\n    bus_notify+0x34/0x50\\n    device_del+0x269/0x3d0\\n    pci_remove_bus_device+0x77/0x100\\n    p2sb_bar+0xae/0x1d0\\n    ...\\n    i801_probe+0x423/0x740\\n\\nUse the release_domain mechanism to fix it. The scalable mode context\\nentry which is not part of release domain should be cleared in\\nrelease_device().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iommu/vt-d: corrige el dominio NULL al lanzar el dispositivo. En el kernel kdump, IOMMU opera en modo deferred_attach. En este modo, es posible que info-\u0026gt;dominio a\u00fan no est\u00e9 asignado cuando se llama a la funci\u00f3n release_device. Conduce al siguiente bloqueo en el kernel bloqueado: ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 000000000000003c ... RIP: 0010:do_raw_spin_lock+0xa/0xa0 ... _raw_spin_lock_irqsave+0x1b/0x30 intel_iommu_release_device+0x96/0x170 +0x39/ 0xf0 __iommu_group_remove_device+0xa0/0xd0 iommu_bus_notifier+0x55/0xb0 notifier_call_chain+0x5a/0xd0 blocking_notifier_call_chain+0x41/0x60 bus_notify+0x34/0x50 device_del+0x269/0x3d0 vice+0x77/0x100 p2sb_bar+0xae/0x1d0 ... i801_probe+0x423/0x740 Uso el mecanismo release_domain para solucionarlo. La entrada de contexto del modo escalable que no forma parte del dominio de lanzamiento debe borrarse en release_device().\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/333fe86968482ca701c609af590003bcea450e8f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/81e921fd321614c2ad8ac333b041aae1da7a1c6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.