cve-2024-35843
Vulnerability from cvelistv5
Published
2024-05-17 14:40
Modified
2024-08-02 03:21
Severity
6.8 (Medium) - cvssV3_1 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Summary
iommu/vt-d: Use device rbtree in iopf reporting path
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "3d39238991e7",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "def054b01a86",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.8.*",
                "status": "unaffected",
                "version": "6.8.2",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "6.9"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35843",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-04T19:36:46.083168Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T19:36:51.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "ADP Container"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.021Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/dmar.c",
            "drivers/iommu/intel/iommu.c",
            "drivers/iommu/intel/iommu.h",
            "drivers/iommu/intel/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d39238991e7",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            },
            {
              "lessThan": "def054b01a86",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/dmar.c",
            "drivers/iommu/intel/iommu.c",
            "drivers/iommu/intel/iommu.h",
            "drivers/iommu/intel/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Use device rbtree in iopf reporting path\n\nThe existing I/O page fault handler currently locates the PCI device by\ncalling pci_get_domain_bus_and_slot(). This function searches the list\nof all PCI devices until the desired device is found. To improve lookup\nefficiency, replace it with device_rbtree_find() to search the device\nwithin the probed device rbtree.\n\nThe I/O page fault is initiated by the device, which does not have any\nsynchronization mechanism with the software to ensure that the device\nstays in the probed device tree. Theoretically, a device could be released\nby the IOMMU subsystem after device_rbtree_find() and before\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\n\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\nrelease device path. This lock doesn\u0027t introduce any performance overhead,\nas the conflict between I/O page fault reporting and device releasing is\nvery rare."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:29:58.282Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15"
        },
        {
          "url": "https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"
        }
      ],
      "title": "iommu/vt-d: Use device rbtree in iopf reporting path",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35843",
    "datePublished": "2024-05-17T14:40:10.747Z",
    "dateReserved": "2024-05-17T13:50:33.104Z",
    "dateUpdated": "2024-08-02T03:21:49.021Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35843\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T15:15:21.313\",\"lastModified\":\"2024-07-03T02:02:16.580\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/vt-d: Use device rbtree in iopf reporting path\\n\\nThe existing I/O page fault handler currently locates the PCI device by\\ncalling pci_get_domain_bus_and_slot(). This function searches the list\\nof all PCI devices until the desired device is found. To improve lookup\\nefficiency, replace it with device_rbtree_find() to search the device\\nwithin the probed device rbtree.\\n\\nThe I/O page fault is initiated by the device, which does not have any\\nsynchronization mechanism with the software to ensure that the device\\nstays in the probed device tree. Theoretically, a device could be released\\nby the IOMMU subsystem after device_rbtree_find() and before\\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\\n\\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\\nrelease device path. This lock doesn\u0027t introduce any performance overhead,\\nas the conflict between I/O page fault reporting and device releasing is\\nvery rare.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iommu/vt-d: use el rbtree del dispositivo en la ruta de informes iopf. El controlador de fallos de la p\u00e1gina de E/S existente actualmente ubica el dispositivo PCI llamando a pci_get_domain_bus_and_slot(). Esta funci\u00f3n busca en la lista de todos los dispositivos PCI hasta encontrar el dispositivo deseado. Para mejorar la eficiencia de la b\u00fasqueda, reempl\u00e1celo con device_rbtree_find() para buscar el dispositivo dentro del rbtree del dispositivo probado. El fallo de la p\u00e1gina de E/S la inicia el dispositivo, que no tiene ning\u00fan mecanismo de sincronizaci\u00f3n con el software para garantizar que el dispositivo permanezca en el \u00e1rbol de dispositivos analizados. En teor\u00eda, el subsistema IOMMU podr\u00eda liberar un dispositivo despu\u00e9s de device_rbtree_find() y antes de iopf_get_dev_fault_param(), lo que causar\u00eda un problema de uso despu\u00e9s de la liberaci\u00f3n. Agregue un mutex para sincronizar la ruta de informe de fallos de la p\u00e1gina de E/S y la ruta del dispositivo de liberaci\u00f3n IOMMU. Este bloqueo no introduce ninguna sobrecarga de rendimiento, ya que el conflicto entre el informe de fallos de la p\u00e1gina de E/S y la liberaci\u00f3n del dispositivo es muy raro.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.5,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.