CVE-2024-53232

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-53232

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: iommu/s390: Implement blocking domain This fixes a crash when surprise hot-unplugging a PCI device. This crash happens because during hot-unplug __iommu_group_set_domain_nofail() attaching the default domain fails when the platform no longer recognizes the device as it has already been removed and we end up with a NULL domain pointer and UAF. This is exactly the case referred to in the second comment in __iommu_device_set_domain() and just as stated there if we can instead attach the blocking domain the UAF is prevented as this can handle the already removed device. Implement the blocking domain to use this handling. With this change, the crash is fixed but we still hit a warning attempting to change DMA ownership on a blocked device.

References
Link Resource
https://git.kernel.org/stable/c/3be34fa1cdbf180c1a948cfededfdf2cdc497199 Patch
https://git.kernel.org/stable/c/bd89d94f3ea6fdaee983cbc69226a00b9bde6d59 Patch
https://git.kernel.org/stable/c/ecda483339a5151e3ca30d6b82691ef6f1d17912 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

03 Feb 2025, 15:29

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iommu/s390: Implementar dominio de bloqueo Esto corrige un fallo al desconectar en caliente por sorpresa un dispositivo PCI. Este fallo ocurre porque durante la desconexión en caliente __iommu_group_set_domain_nofail() la conexión del dominio predeterminado falla cuando la plataforma ya no reconoce el dispositivo porque ya se ha eliminado y terminamos con un puntero de dominio NULL y UAF. Este es exactamente el caso al que se hace referencia en el segundo comentario en __iommu_device_set_domain() y tal como se indica allí, si en su lugar podemos conectar el dominio de bloqueo, se evita el UAF ya que puede gestionar el dispositivo ya eliminado. Implemente el dominio de bloqueo para usar esta gestión. Con este cambio, el fallo se corrige, pero aún encontramos una advertencia al intentar cambiar la propiedad de DMA en un dispositivo bloqueado.
CWE CWE-476
CWE-416
References () https://git.kernel.org/stable/c/3be34fa1cdbf180c1a948cfededfdf2cdc497199 - () https://git.kernel.org/stable/c/3be34fa1cdbf180c1a948cfededfdf2cdc497199 - Patch
References () https://git.kernel.org/stable/c/bd89d94f3ea6fdaee983cbc69226a00b9bde6d59 - () https://git.kernel.org/stable/c/bd89d94f3ea6fdaee983cbc69226a00b9bde6d59 - Patch
References () https://git.kernel.org/stable/c/ecda483339a5151e3ca30d6b82691ef6f1d17912 - () https://git.kernel.org/stable/c/ecda483339a5151e3ca30d6b82691ef6f1d17912 - Patch

27 Dec 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-27 14:15

Updated : 2025-02-10 18:15

NVD link : CVE-2024-53232

Mitre link : CVE-2024-53232

CVE.ORG link : CVE-2024-53232

JSON object : View

Products Affected

linux

CWE
CWE-416

Use After Free

CWE-476

NULL Pointer Dereference