{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-43877", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-17T09:11:59.281Z", "datePublished": "2024-08-21T00:06:29.330Z", "dateUpdated": "2026-08-05T11:36:53.441Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:53.441Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pci: ivtv: Add check for DMA map result\n\nIn case DMA fails, 'dma->SG_length' is 0. This value is later used to\naccess 'dma->SGarray[dma->SG_length - 1]', which will cause out of\nbounds access.\n\nAdd check to return early on invalid value. Adjust warnings accordingly.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached only through local device nodes — `write()`/`ioctl(IVTVFB_IOC_DMA_FRAME)` on `/dev/fbN` and `write()`/`ioctl(IVTV_IOC_DMA_FRAME)` on the ivtv decoder video node. No remote or adjacent-network input reaches this path.\nAC:L - The attacker fully controls the userspace buffer address and the transfer size (up to 704 pages per call) and can retry the operation in an unbounded loop; because the card is 32-bit DMA-masked, every high page consumes shared swiotlb/32-bit IOVA resources that the attacker can pressure and exhaust, and once `dma_map_sg()` returns 0 the out-of-bounds write is deterministic.\nPR:L - There is no `capable()` or other privilege check anywhere along the path — access is governed solely by permissions on `/dev/video*` and `/dev/fb*`, which are held by ordinary console/desktop users in the `video` group and by non-root media daemons on set-top-box and embedded appliances.\nUI:N - The attacker triggers the bug entirely from their own process with a single `write()` or `ioctl()` call; no action by any other user is required.\nS:U - The corruption and its consequences stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed by the negative-index write itself.\nC:H - The corrupted `bouncemap[703]` page pointer is subsequently used as a bounce-buffer source, and the driver additionally programs the card with a stale SG array of already-unmapped DMA addresses, causing kernel memory the driver no longer owns to be copied into decoder RAM that userspace can read back — a memory-corruption primitive leveragable for arbitrary kernel disclosure.\nI:H - This is an out-of-bounds write that ORs bit 63 into an adjacent `struct page *`, and that poisoned pointer is later fed to `page_address()` + `memcpy()` with attacker-controlled data and to `__free_page()` — yielding a wild kernel write and page-allocator corruption suitable for control-flow hijacking.\nA:H - The failed transfer leaves no SG entry tagged with the completion-interrupt bit and arms no DMA timeout timer, so the caller loops forever in `schedule()` while holding `itv->udma.lock`, permanently wedging the driver; the wild `__free_page()`/`page_address()` dereferences additionally produce a kernel oops." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/pci/ivtv/ivtv-udma.c", "drivers/media/pci/ivtv/ivtv-yuv.c", "drivers/media/pci/ivtv/ivtvfb.c" ], "versions": [ { "version": "4551236b55e80b2c1720b10b77e9400118b2339e", "lessThan": "38f72c7e7c6b55614f9407555fd5ce9d019b0fa4", "status": "affected", "versionType": "git" }, { "version": "66c8a83bf1de2eb3eea4734c7eda22255a965f11", "lessThan": "81d0664bed91a858c7b50c263954b59d65f1b414", "status": "affected", "versionType": "git" }, { "version": "1932dc2f4cf6ac23e48e5fcc24d21adbe35691d1", "lessThan": "24062aa7407091dee3e45a8e8037df437e848718", "status": "affected", "versionType": "git" }, { "version": "1932dc2f4cf6ac23e48e5fcc24d21adbe35691d1", "lessThan": "3d8fd92939e21ff0d45100ab208f8124af79402a", "status": "affected", "versionType": "git" }, { "version": "1932dc2f4cf6ac23e48e5fcc24d21adbe35691d1", "lessThan": "c766065e8272085ea9c436414b7ddf1f12e7787b", "status": "affected", "versionType": "git" }, { "version": "1932dc2f4cf6ac23e48e5fcc24d21adbe35691d1", "lessThan": "629913d6d79508b166c66e07e4857e20233d85a9", "status": "affected", "versionType": "git" }, { "version": "1b00b7335000c0e107f774cc8ee4d5340f824f28", "status": "affected", "versionType": "git" }, { "version": "5.4.301", "lessThan": "5.5", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/pci/ivtv/ivtv-udma.c", "drivers/media/pci/ivtv/ivtv-yuv.c", "drivers/media/pci/ivtv/ivtvfb.c" ], "versions": [ { "version": "5.16", "status": "affected" }, { "version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.103", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.44", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.3", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.103" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.10.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.301" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/38f72c7e7c6b55614f9407555fd5ce9d019b0fa4" }, { "url": "https://git.kernel.org/stable/c/81d0664bed91a858c7b50c263954b59d65f1b414" }, { "url": "https://git.kernel.org/stable/c/24062aa7407091dee3e45a8e8037df437e848718" }, { "url": "https://git.kernel.org/stable/c/3d8fd92939e21ff0d45100ab208f8124af79402a" }, { "url": "https://git.kernel.org/stable/c/c766065e8272085ea9c436414b7ddf1f12e7787b" }, { "url": "https://git.kernel.org/stable/c/629913d6d79508b166c66e07e4857e20233d85a9" } ], "title": "media: pci: ivtv: Add check for DMA map result", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-43877", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:06:00.730463Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:17.774Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:06:27.712Z" } } ] } }