{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-32936", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-24T13:54:11.064Z", "datePublished": "2024-06-24T13:56:48.054Z", "dateUpdated": "2026-08-05T11:29:49.671Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:49.671Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ti: j721e-csi2rx: Fix races while restarting DMA\n\nAfter the frame is submitted to DMA, it may happen that the submitted\nlist is not updated soon enough, and the DMA callback is triggered\nbefore that.\n\nThis can lead to kernel crashes, so move everything in a single\nlock/unlock section to prevent such races." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is entered exclusively through `VIDIOC_QBUF` ioctls on the `/dev/videoN` node exported by the j721e-csi2rx capture driver, requiring local system access. No network or physical access is involved.\nAC:L - The attacker creates and controls both sides of the race: buffer starvation is induced at will by withholding QBUF until `dma->state` becomes `TI_CSI2RX_DMA_IDLE`, and the QBUF that reopens the unlocked window is issued at a chosen instant, repeatable every frame period with unlimited retries; the DMA completion fires promptly because the PSI-L endpoint is already backed up in exactly this stalled state.\nPR:L - Only an unprivileged local account with access to the V4L2 device node is needed — `v4l2_fh_open` and the vb2 qbuf path perform no capability checks whatsoever. On the affected J721e/AM62 embedded and automotive platforms this is an ordinary camera-capable application user.\nUI:N - The attacking process drives the entire sequence itself via REQBUFS/STREAMON/QBUF; no action by any other user or victim is required.\nS:U - The corruption is confined to kernel heap objects (vb2 buffer structures and the driver's DMA lists) within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `list_del()` on an unlinked buffer plus double-ownership of vb2 buffers between the driver and userspace yields heap corruption over groomable `kmalloc-2k` objects, which can be leveraged to read adjacent kernel memory; the premature `vb2_buffer_done()` also exposes DMA-target contents to userspace out of sequence.\nI:H - `__list_del()` writes `next->prev`/`prev->next` through stale or poisoned pointers on the buffer's `list_head`, and the doubly-owned buffer allows a second `list_add_tail()` cross-linking `dma->queue` and `dma->submitted` — a classic list-corruption write primitive suitable for control-flow hijack.\nA:H - The commit explicitly states the race \"can lead to kernel crashes,\" and the sibling fix for the same callback documents `kernel BUG at lib/list_debug.c:65` escalating to \"Kernel panic - not syncing: Fatal exception in interrupt\" because the corruption occurs in softirq context." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c" ], "versions": [ { "version": "b4a3d877dc92963a4db16ddb71df3d333c0d40bd", "lessThan": "80a8b92950f8ee96582dba6187e3c2deca3569ea", "status": "affected", "versionType": "git" }, { "version": "b4a3d877dc92963a4db16ddb71df3d333c0d40bd", "lessThan": "ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c" ], "versions": [ { "version": "6.7", "status": "affected" }, { "version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.4", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.9.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea" }, { "url": "https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b" } ], "title": "media: ti: j721e-csi2rx: Fix races while restarting DMA", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:27:52.128Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-32936", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T17:08:40.067111Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:43.640Z" } } ] } }