{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-53126", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:24.995Z", "datePublished": "2024-12-04T14:20:30.788Z", "dateUpdated": "2026-08-05T11:43:56.206Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:43:56.206Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: solidrun: Fix UB bug with devres\n\nIn psnet_open_pf_bar() and snet_open_vf_bar() a string later passed to\npcim_iomap_regions() is placed on the stack. Neither\npcim_iomap_regions() nor the functions it calls copy that string.\n\nShould the string later ever be used, this, consequently, causes\nundefined behavior since the stack frame will by then have disappeared.\n\nFix the bug by allocating the strings on the heap through\ndevm_kasprintf()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The stale pointer is dereferenced only when a local process reads /proc/iomem (or the resource tree is otherwise printed); there is no network- or adjacent-reachable path into this PCI probe-time bug.\nAC:L - On any system where the SolidNET DPU driver has probed, the dangling name pointer is unconditionally present in the iomem resource tree and is dereferenced deterministically on every /proc/iomem read, with no race or unpredictable precondition to win.\nPR:L - /proc/iomem is world-readable (mode 0444) and r_show() prints the resource name regardless of CAP_SYS_ADMIN — only masking the addresses — so a plain unprivileged local user or container tenant triggers the dereference.\nUI:N - No victim action is needed; the attacker reads /proc/iomem themselves and the dangling pointer was installed automatically at device probe.\nS:U - The stale read and any resulting oops stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The %s dereference copies freed/reused kernel stack memory to userspace, unbounded until the first NUL byte, repeatably and at attacker-chosen timing, leaking kernel pointers (KASLR defeat) and other tasks' stack data whose content can be shaped by stack spraying.\nI:N - The dangling resource->name is only ever read for printing; nothing in the resource or PCI devres code writes through it, so no data modification or control-flow primitive arises.\nA:H - If the probing task's vmap'd stack has been freed and unmapped, or the NUL-less scan runs off into a stack guard page, the unchecked kernel read page-faults with no fixup, oopsing the kernel on an unprivileged /proc/iomem read." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/vdpa/solidrun/snet_main.c" ], "versions": [ { "version": "51a8f9d7f587290944d6fc733d1f897091c63159", "lessThan": "d372dd09cfbf1324f54cbffd81fcaf6cdf3e608e", "status": "affected", "versionType": "git" }, { "version": "51a8f9d7f587290944d6fc733d1f897091c63159", "lessThan": "5bb287da2d2d5bb8f7376e223b02edb16998982e", "status": "affected", "versionType": "git" }, { "version": "51a8f9d7f587290944d6fc733d1f897091c63159", "lessThan": "0b364cf53b20204e92bac7c6ebd1ee7d3ec62931", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/vdpa/solidrun/snet_main.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.63", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.10", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.63" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.11.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d372dd09cfbf1324f54cbffd81fcaf6cdf3e608e" }, { "url": "https://git.kernel.org/stable/c/5bb287da2d2d5bb8f7376e223b02edb16998982e" }, { "url": "https://git.kernel.org/stable/c/0b364cf53b20204e92bac7c6ebd1ee7d3ec62931" } ], "title": "vdpa: solidrun: Fix UB bug with devres", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-53126", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:10:15.577361Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:17:10.171Z" } } ] } }