cve-2024-46824
Vulnerability from cvelistv5
Published
2024-09-27 12:39
Modified
2024-12-19 09:23
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: iommufd: Require drivers to supply the cache_invalidate_user ops If drivers don't do this then iommufd will oops invalidation ioctls with something like: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000086000004 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101059000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 371 Comm: qemu-system-aar Not tainted 6.8.0-rc7-gde77230ac23a #9 Hardware name: linux,dummy-virt (DT) pstate: 81400809 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=-c) pc : 0x0 lr : iommufd_hwpt_invalidate+0xa4/0x204 sp : ffff800080f3bcc0 x29: ffff800080f3bcf0 x28: ffff0000c369b300 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000000 x22: 00000000c1e334a0 x21: ffff0000c1e334a0 x20: ffff800080f3bd38 x19: ffff800080f3bd58 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffff8240d6d8 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000001000000002 x7 : 0000fffeac1ec950 x6 : 0000000000000000 x5 : ffff800080f3bd78 x4 : 0000000000000003 x3 : 0000000000000002 x2 : 0000000000000000 x1 : ffff800080f3bcc8 x0 : ffff0000c6034d80 Call trace: 0x0 iommufd_fops_ioctl+0x154/0x274 __arm64_sys_ioctl+0xac/0xf0 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xb4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x190/0x194 All existing drivers implement this op for nesting, this is mostly a bisection aid.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/89827a4de802765b1ebb401fc1e73a90108c7520Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a11dda723c6493bb1853bbc61c093377f96e2d47Patch
Impacted products
Vendor Product Version
Linux Linux Version: 6.8
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46824",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:13:16.952479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:13:26.663Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/hw_pagetable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "89827a4de802765b1ebb401fc1e73a90108c7520",
              "status": "affected",
              "version": "8c6eabae3807e048b9f17733af5e20500fbf858c",
              "versionType": "git"
            },
            {
              "lessThan": "a11dda723c6493bb1853bbc61c093377f96e2d47",
              "status": "affected",
              "version": "8c6eabae3807e048b9f17733af5e20500fbf858c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/hw_pagetable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Require drivers to supply the cache_invalidate_user ops\n\nIf drivers don\u0027t do this then iommufd will oops invalidation ioctls with\nsomething like:\n\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n  Mem abort info:\n    ESR = 0x0000000086000004\n    EC = 0x21: IABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n    FSC = 0x04: level 0 translation fault\n  user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101059000\n  [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\n  Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP\n  Modules linked in:\n  CPU: 2 PID: 371 Comm: qemu-system-aar Not tainted 6.8.0-rc7-gde77230ac23a #9\n  Hardware name: linux,dummy-virt (DT)\n  pstate: 81400809 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=-c)\n  pc : 0x0\n  lr : iommufd_hwpt_invalidate+0xa4/0x204\n  sp : ffff800080f3bcc0\n  x29: ffff800080f3bcf0 x28: ffff0000c369b300 x27: 0000000000000000\n  x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000\n  x23: 0000000000000000 x22: 00000000c1e334a0 x21: ffff0000c1e334a0\n  x20: ffff800080f3bd38 x19: ffff800080f3bd58 x18: 0000000000000000\n  x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffff8240d6d8\n  x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n  x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000\n  x8 : 0000001000000002 x7 : 0000fffeac1ec950 x6 : 0000000000000000\n  x5 : ffff800080f3bd78 x4 : 0000000000000003 x3 : 0000000000000002\n  x2 : 0000000000000000 x1 : ffff800080f3bcc8 x0 : ffff0000c6034d80\n  Call trace:\n   0x0\n   iommufd_fops_ioctl+0x154/0x274\n   __arm64_sys_ioctl+0xac/0xf0\n   invoke_syscall+0x48/0x110\n   el0_svc_common.constprop.0+0x40/0xe0\n   do_el0_svc+0x1c/0x28\n   el0_svc+0x34/0xb4\n   el0t_64_sync_handler+0x120/0x12c\n   el0t_64_sync+0x190/0x194\n\nAll existing drivers implement this op for nesting, this is mostly a\nbisection aid."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:23:56.191Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/89827a4de802765b1ebb401fc1e73a90108c7520"
        },
        {
          "url": "https://git.kernel.org/stable/c/a11dda723c6493bb1853bbc61c093377f96e2d47"
        }
      ],
      "title": "iommufd: Require drivers to supply the cache_invalidate_user ops",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46824",
    "datePublished": "2024-09-27T12:39:24.563Z",
    "dateReserved": "2024-09-11T15:12:18.285Z",
    "dateUpdated": "2024-12-19T09:23:56.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46824\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-27T13:15:14.960\",\"lastModified\":\"2024-10-02T14:29:08.417\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommufd: Require drivers to supply the cache_invalidate_user ops\\n\\nIf drivers don\u0027t do this then iommufd will oops invalidation ioctls with\\nsomething like:\\n\\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\\n  Mem abort info:\\n    ESR = 0x0000000086000004\\n    EC = 0x21: IABT (current EL), IL = 32 bits\\n    SET = 0, FnV = 0\\n    EA = 0, S1PTW = 0\\n    FSC = 0x04: level 0 translation fault\\n  user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101059000\\n  [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\\n  Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP\\n  Modules linked in:\\n  CPU: 2 PID: 371 Comm: qemu-system-aar Not tainted 6.8.0-rc7-gde77230ac23a #9\\n  Hardware name: linux,dummy-virt (DT)\\n  pstate: 81400809 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=-c)\\n  pc : 0x0\\n  lr : iommufd_hwpt_invalidate+0xa4/0x204\\n  sp : ffff800080f3bcc0\\n  x29: ffff800080f3bcf0 x28: ffff0000c369b300 x27: 0000000000000000\\n  x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000\\n  x23: 0000000000000000 x22: 00000000c1e334a0 x21: ffff0000c1e334a0\\n  x20: ffff800080f3bd38 x19: ffff800080f3bd58 x18: 0000000000000000\\n  x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffff8240d6d8\\n  x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\\n  x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000\\n  x8 : 0000001000000002 x7 : 0000fffeac1ec950 x6 : 0000000000000000\\n  x5 : ffff800080f3bd78 x4 : 0000000000000003 x3 : 0000000000000002\\n  x2 : 0000000000000000 x1 : ffff800080f3bcc8 x0 : ffff0000c6034d80\\n  Call trace:\\n   0x0\\n   iommufd_fops_ioctl+0x154/0x274\\n   __arm64_sys_ioctl+0xac/0xf0\\n   invoke_syscall+0x48/0x110\\n   el0_svc_common.constprop.0+0x40/0xe0\\n   do_el0_svc+0x1c/0x28\\n   el0_svc+0x34/0xb4\\n   el0t_64_sync_handler+0x120/0x12c\\n   el0t_64_sync+0x190/0x194\\n\\nAll existing drivers implement this op for nesting, this is mostly a\\nbisection aid.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iommufd: Requiere que los controladores proporcionen las operaciones cache_invalidate_user Si los controladores no hacen esto, iommufd oops invalidar\u00e1 los ioctls con algo como: No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\u00f3n virtual 0000000000000000 Informaci\u00f3n de aborto de memoria: ESR = 0x0000000086000004 EC = 0x21: IABT (EL actual), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: error de traducci\u00f3n de nivel 0 pgtable de usuario: 4k p\u00e1ginas, VA de 48 bits, pgdp=0000000101059000 [000000000000000] pgd=0000000000000000, p4d=0000000000000000 Error interno: Oops: 0000000086000004 [#1] PREEMPT M\u00f3dulos SMP vinculados: CPU: 2 PID: 371 Comm: qemu-system-aar No contaminado 6.8.0-rc7-gde77230ac23a #9 Nombre del hardware: linux,dummy-virt (DT) pstate: 81400809 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=-c) pc : 0x0 lr : iommufd_hwpt_invalidate+0xa4/0x204 sp : ffff800080f3bcc0 x29: ffff800080f3bcf0 x28: ffff0000c369b300 x27: 0000000000000000 x26: 0000000000000000 x25: 00000000000000000 x24: 0000000000000000 x23: 000000000000000 x22: 00000000c1e334a0 x21: ffff0000c1e334a0 x20: ffff800080f3bd38 x19: ffff800080f3bd58 x18: 0000000000000000 x17: 00000000000000000 x16: 0000000000000000 x15: 0000ffff8240d6d8 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 000000000000000 x9: 000000000000000 x8: 0000001000000002 x7: 0000fffeac1ec950 x6: 0000000000000000 x5: ffff800080f3bd78 x4: 0000000000000003 x3: 0000000000000002 x2: 0000000000000000 x1: ffff800080f3bcc8 x0: ffff0000c6034d80 Rastreo de llamadas: 0x0 iommufd_fops_ioctl+0x154/0x274 __arm64_sys_ioctl+0xac/0xf0 anybody_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xb4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x190/0x194 Todos los controladores existentes implementan esta operaci\u00f3n para anidamiento, esto es principalmente una ayuda de bisecci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"4FAFFECB-D55B-4130-801C-AE52B8A6B1BA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/89827a4de802765b1ebb401fc1e73a90108c7520\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a11dda723c6493bb1853bbc61c093377f96e2d47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.