Vulnerability-Lookup

GHSA-F5H4-685P-R266

Vulnerability from github – Published: 2024-10-21 15:32 – Updated: 2025-11-04 00:31

Details

In the Linux kernel, the following vulnerability has been resolved:

crypto: hisilicon/qm - inject error before stopping queue

The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-47730"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-21T13:15:03Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - inject error before stopping queue\n\nThe master ooo cannot be completely closed when the\naccelerator core reports memory error. Therefore, the driver\nneeds to inject the qm error to close the master ooo. Currently,\nthe qm error is injected after stopping queue, memory may be\nreleased immediately after stopping queue, causing the device to\naccess the released memory. Therefore, error is injected to close master\nooo before stopping queue to ensure that the device does not access\nthe released memory.",
  "id": "GHSA-f5h4-685p-r266",
  "modified": "2025-11-04T00:31:38Z",
  "published": "2024-10-21T15:32:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47730"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/801d64177faaec184cee1e1aa4d8487df1364a54"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/85e81103033324d7a271dafb584991da39554a89"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/98d3be34c9153eceadb56de50d9f9347e88d86e4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aa3e0db35a60002fb34ef0e4ad203aa59fd00203"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b04f06fc0243600665b3b50253869533b7938468"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c5f5b813e546f7fe133539c3d7a5086cc8dd2aa1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f8024f12752e32ffbbf59e1c09d949f977ff743f"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-47730 (GCVE-0-2024-47730)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:14 – Updated: 2026-08-05 11:39

Title

crypto: hisilicon/qm - inject error before stopping queue

Summary

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - inject error before stopping queue The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-21 13:00 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/85e81103033324d7a…
https://git.kernel.org/stable/c/801d64177faaec184…
https://git.kernel.org/stable/c/98d3be34c9153ecea…
https://git.kernel.org/stable/c/aa3e0db35a60002fb…
https://git.kernel.org/stable/c/f8024f12752e32ffb…
https://git.kernel.org/stable/c/c5f5b813e546f7fe1…
https://git.kernel.org/stable/c/b04f06fc024360066…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 6c6dd5802c2d6769fa589c0e8de54299def199a7 , < 85e81103033324d7a271dafb584991da39554a89 (git) Affected: 6c6dd5802c2d6769fa589c0e8de54299def199a7 , < 801d64177faaec184cee1e1aa4d8487df1364a54 (git) Affected: 6c6dd5802c2d6769fa589c0e8de54299def199a7 , < 98d3be34c9153eceadb56de50d9f9347e88d86e4 (git) Affected: 6c6dd5802c2d6769fa589c0e8de54299def199a7 , < aa3e0db35a60002fb34ef0e4ad203aa59fd00203 (git) Affected: 6c6dd5802c2d6769fa589c0e8de54299def199a7 , < f8024f12752e32ffbbf59e1c09d949f977ff743f (git) Affected: 6c6dd5802c2d6769fa589c0e8de54299def199a7 , < c5f5b813e546f7fe133539c3d7a5086cc8dd2aa1 (git) Affected: 6c6dd5802c2d6769fa589c0e8de54299def199a7 , < b04f06fc0243600665b3b50253869533b7938468 (git)
Linux	Linux	Affected: 5.8 Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.174 , ≤ 5.15.* (semver) Unaffected: 6.1.113 , ≤ 6.1.* (semver) Unaffected: 6.6.54 , ≤ 6.6.* (semver) Unaffected: 6.10.13 , ≤ 6.10.* (semver) Unaffected: 6.11.2 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47730",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:00:38.367655Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:16.049Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:21:26.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/hisilicon/qm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "85e81103033324d7a271dafb584991da39554a89",
              "status": "affected",
              "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7",
              "versionType": "git"
            },
            {
              "lessThan": "801d64177faaec184cee1e1aa4d8487df1364a54",
              "status": "affected",
              "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7",
              "versionType": "git"
            },
            {
              "lessThan": "98d3be34c9153eceadb56de50d9f9347e88d86e4",
              "status": "affected",
              "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7",
              "versionType": "git"
            },
            {
              "lessThan": "aa3e0db35a60002fb34ef0e4ad203aa59fd00203",
              "status": "affected",
              "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7",
              "versionType": "git"
            },
            {
              "lessThan": "f8024f12752e32ffbbf59e1c09d949f977ff743f",
              "status": "affected",
              "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7",
              "versionType": "git"
            },
            {
              "lessThan": "c5f5b813e546f7fe133539c3d7a5086cc8dd2aa1",
              "status": "affected",
              "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7",
              "versionType": "git"
            },
            {
              "lessThan": "b04f06fc0243600665b3b50253869533b7938468",
              "status": "affected",
              "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/hisilicon/qm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - inject error before stopping queue\n\nThe master ooo cannot be completely closed when the\naccelerator core reports memory error. Therefore, the driver\nneeds to inject the qm error to close the master ooo. Currently,\nthe qm error is injected after stopping queue, memory may be\nreleased immediately after stopping queue, causing the device to\naccess the released memory. Therefore, error is injected to close master\nooo before stopping queue to ensure that the device does not access\nthe released memory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the PF reset path of a local PCIe crypto accelerator (drivers/crypto/hisilicon/qm.c), reached only via the device\u0027s abnormal interrupt handler or the PCIe AER slot-reset callback on the host itself. The affected principal is a local user/process holding accelerator queues through uacce or the kernel crypto API; there is no remote or adjacent protocol involved.\nAC:H - The defective ordering only bites when `err_status.is_dev_ecc_mbit`/`is_qm_ecc_mbit` is set, i.e. after an uncorrectable ECC multi-bit fault in the accelerator\u0027s internal SRAM (`ecc_2bits_mask`) \u2014 a spontaneous hardware memory error the attacker cannot induce, since the injection registers at BAR offsets \u22650x100000 are outside the \u22648 KB uacce MMIO mapping. The attacker must additionally hit the narrow window between `hisi_qm_stop()` freeing queue memory and the later master-ooo close, and the path is limited to pre-V3 (Kunpeng 920) hardware.\nPR:L - An unprivileged local user with a uacce queue (/dev/hisi_zip-N, /dev/hisi_sec2-N, etc.) or ordinary use of the accelerator through the kernel crypto API is enough to be in the affected state and to control when the queue memory is released; no CAP_SYS_ADMIN or root is needed to hold a queue.\nUI:N - The controller reset is scheduled automatically from `qm_abnormal_irq()`/AER without any user action, and the memory release follows from normal queue teardown. No victim must open a file, mount a filesystem, or perform any other action.\nS:U - The stale DMA corrupts kernel/DMA memory managed by the same kernel that contains the vulnerable driver; no VM, IOMMU, or sandbox boundary is crossed \u2014 where an IOMMU is active the stale accesses fault rather than escaping a boundary.\nC:H - The still-active AXI master performs out-of-order reads of released memory that has been returned to the allocator and reused by unrelated kernel or process allocations, and those reads can be reflected back into user-visible completion/output buffers \u2014 an effective use-after-free read primitive over arbitrary reallocated pages.\nI:H - The device continues writing out-of-order results into freed pages after `hisi_qm_stop()`/`qm_clear_queues()`, so accelerator output whose content is influenced by the in-flight job lands in memory now owned by other kernel objects \u2014 a DMA use-after-free write giving heap corruption and a path to control-flow hijack.\nA:H - DMA into freed and reallocated memory reliably causes kernel corruption, oops or panic; additionally, when the master ooo cannot be closed, `qm_master_ooo_check()` times out with \"Bus lock! Please reset system.\", the controller reset fails, and the accelerator is permanently isolated."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:47.501Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/85e81103033324d7a271dafb584991da39554a89"
        },
        {
          "url": "https://git.kernel.org/stable/c/801d64177faaec184cee1e1aa4d8487df1364a54"
        },
        {
          "url": "https://git.kernel.org/stable/c/98d3be34c9153eceadb56de50d9f9347e88d86e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa3e0db35a60002fb34ef0e4ad203aa59fd00203"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8024f12752e32ffbbf59e1c09d949f977ff743f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5f5b813e546f7fe133539c3d7a5086cc8dd2aa1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b04f06fc0243600665b3b50253869533b7938468"
        }
      ],
      "title": "crypto: hisilicon/qm - inject error before stopping queue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47730",
    "datePublished": "2024-10-21T12:14:02.378Z",
    "dateReserved": "2024-09-30T16:00:12.957Z",
    "dateUpdated": "2026-08-05T11:39:47.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.