{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-43856", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-17T09:11:59.278Z", "datePublished": "2024-08-17T09:24:26.560Z", "dateUpdated": "2026-08-05T11:36:49.175Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:49.175Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma: fix call order in dmam_free_coherent\n\ndmam_free_coherent() frees a DMA allocation, which makes the\nfreed vaddr available for reuse, then calls devres_destroy()\nto remove and free the data structure used to track the DMA\nallocation. Between the two calls, it is possible for a\nconcurrent task to make an allocation with the same vaddr\nand add it to the devres list.\n\nIf this happens, there will be two entries in the devres list\nwith the same vaddr and devres_destroy() can free the wrong\nentry, triggering the WARN_ON() in dmam_match.\n\nFix by destroying the devres entry before freeing the DMA\nallocation.\n\n kokonut //net/encryption\n http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - `dmam_free_coherent()` is a driver-internal managed-DMA helper reached only by locally driving a driver's DMA alloc/free path (ALSA PCM open/close, FireWire `/dev/fw*` ioctl, ethtool ring reconfig, bind/unbind). No remote peer data or packet-processing path drives it.\nAC:L - The attacker controls both sides of the race — two threads hammering alloc and free on the same `struct device` — and can retry indefinitely, while the LIFO behaviour of the page allocator makes the freed vaddr very likely to be handed straight back to the concurrent allocation. Nothing required is outside the attacker's influence.\nPR:L - An ordinary unprivileged local user with access to the relevant device node can drive it: `sprd_pcm_open()`/`sprd_pcm_close()` do `dmam_alloc_coherent()`/`dmam_free_coherent()` on the shared `component->dev` for every PCM open/close, and `/dev/fw*` ioctls trigger the FireWire config-ROM alloc while the bus-reset work item frees concurrently. No capability or root is needed on those paths.\nUI:N - The attacker's own threads create the race entirely; no victim action, mount, or file open by another user is required.\nS:U - The corrupted devres list, the DMA allocator state, and the resulting freed memory all belong to the kernel itself, so the impact stays within the vulnerable component's security authority.\nC:H - The stale devres entry causes `dma_free_attrs()` on a live buffer at driver detach, so the pages are recycled into arbitrary kernel objects while the original owner and the device still read them, yielding an arbitrary kernel-memory disclosure primitive.\nI:H - The wrong-entry destruction produces a double-free/UAF of DMA-coherent memory with a mismatched size and dma_handle, leaving a device with a stale IOVA mapping and the allocator writing into recycled pages — a heap-corruption and arbitrary-write primitive suitable for control-flow hijack.\nA:H - The immediate observable effect is the `WARN_ON()` in `dmam_match()`/`dmam_free_coherent()`, which panics the box under `panic_on_warn`, and the subsequent DMA double-free reliably oopses the kernel." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/dma/mapping.c" ], "versions": [ { "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "fe2d246080f035e0af5793cb79067ba125e4fb63", "status": "affected", "versionType": "git" }, { "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "2f7bbdc744f2e7051d1cb47c8e082162df1923c9", "status": "affected", "versionType": "git" }, { "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "257193083e8f43907e99ea633820fc2b3bcd24c7", "status": "affected", "versionType": "git" }, { "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "87b34c8c94e29fa01d744e5147697f592998d954", "status": "affected", "versionType": "git" }, { "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "f993a4baf6b622232e4c190d34c220179e5d61eb", "status": "affected", "versionType": "git" }, { "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "1fe97f68fce1ba24bf823bfb0eb0956003473130", "status": "affected", "versionType": "git" }, { "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "22094f5f52e7bc16c5bf9613365049383650b02e", "status": "affected", "versionType": "git" }, { "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "28e8b7406d3a1f5329a03aa25a43aa28e087cb20", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/dma/mapping.c" ], "versions": [ { "version": "2.6.21", "status": "affected" }, { "version": "0", "lessThan": "2.6.21", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.320", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.282", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.224", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.165", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.103", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.44", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.3", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "4.19.320" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "5.4.282" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "5.10.224" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "5.15.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "6.1.103" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "6.6.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "6.10.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/fe2d246080f035e0af5793cb79067ba125e4fb63" }, { "url": "https://git.kernel.org/stable/c/2f7bbdc744f2e7051d1cb47c8e082162df1923c9" }, { "url": "https://git.kernel.org/stable/c/257193083e8f43907e99ea633820fc2b3bcd24c7" }, { "url": "https://git.kernel.org/stable/c/87b34c8c94e29fa01d744e5147697f592998d954" }, { "url": "https://git.kernel.org/stable/c/f993a4baf6b622232e4c190d34c220179e5d61eb" }, { "url": "https://git.kernel.org/stable/c/1fe97f68fce1ba24bf823bfb0eb0956003473130" }, { "url": "https://git.kernel.org/stable/c/22094f5f52e7bc16c5bf9613365049383650b02e" }, { "url": "https://git.kernel.org/stable/c/28e8b7406d3a1f5329a03aa25a43aa28e087cb20" } ], "title": "dma: fix call order in dmam_free_coherent", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-43856", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:07:08.178694Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:20.523Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:05:56.178Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T11:56:58.649Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ] } ] } }