{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-56719", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-27T15:00:39.858Z", "datePublished": "2024-12-29T08:48:51.495Z", "dateUpdated": "2026-08-05T11:46:17.079Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:17.079Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix TSO DMA API usage causing oops\n\nCommit 66600fac7a98 (\"net: stmmac: TSO: Fix unbalanced DMA map/unmap\nfor non-paged SKB data\") moved the assignment of tx_skbuff_dma[]'s\nmembers to be later in stmmac_tso_xmit().\n\nThe buf (dma cookie) and len stored in this structure are passed to\ndma_unmap_single() by stmmac_tx_clean(). The DMA API requires that\nthe dma cookie passed to dma_unmap_single() is the same as the value\nreturned from dma_map_single(). However, by moving the assignment\nlater, this is not the case when priv->dma_cap.addr64 > 32 as \"des\"\nis offset by proto_hdr_len.\n\nThis causes problems such as:\n\n dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed\n\nand with DMA_API_DEBUG enabled:\n\n DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes]\n\nFix this by maintaining \"des\" as the original DMA cookie, and use\ntso_des to pass the offset DMA cookie to stmmac_tso_allocator().\n\nFull details of the crashes can be found at:\nhttps://lore.kernel.org/all/d8112193-0386-4e14-b516-37c2d838171a@nvidia.com/\nhttps://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5turc@bwwhelz2l4dw/" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The buggy path is `stmmac_xmit()` → `stmmac_tso_xmit()`, taken for any GSO/TSO skb, so a remote unauthenticated peer reaches it simply by soliciting bulk data from any listening service or by pushing traffic that a dwmac/xgmac-based router, gateway or automotive SoC forwards out the stmmac interface. No local access is required to drive the vulnerable code.\nAC:L - The DMA cookie/length mismatch occurs on every TSO transmit on the affected (addr64 > 32) hardware, and the damaging oversized IOVA unmap/free triggers on a large fraction of frames purely as a function of buffer alignment, so an attacker pushing bulk traffic hits it within milliseconds with no condition outside their control.\nPR:N - There is no capability, credential or authentication check anywhere between packet transmission and `stmmac_tso_xmit()`; merely causing the host to send large TCP/UDP-GSO data (e.g. an HTTP GET against a public service, or routed traffic) is sufficient.\nUI:N - No victim action is needed — the bug fires automatically during ordinary transmit processing driven entirely by the attacker's traffic.\nS:C - The defect corrupts IOMMU/IOVA bookkeeping, unmapping and freeing translation ranges belonging to other live DMA mappings, so the NIC ends up with (or loses) translations outside its granted allocation — a breach of the IOMMU/DMA isolation boundary that confines a DMA-capable device, not merely a fault contained within the driver.\nC:H - Aliased and leaked IOVA mappings let the device read host memory outside the intended buffer and transmit it onto the wire, and the corrupted mapping state is memory corruption that can be leveraged for kernel memory disclosure.\nI:H - Over-freed IOVA ranges are handed out again while still in use, so device DMA — including remote-attacker-controlled received packet payloads written into RX buffers — can land in unrelated kernel pages, giving an arbitrary-write style memory corruption primitive.\nA:H - The commit is explicitly titled \"fix TSO DMA API usage causing oops\" and links to crash reports; in practice it yields `WARN_ON` in `__iommu_dma_unmap()`, SMMU translation faults, kernel oopses, and permanent `Tx DMA map failed` transmit failure that takes the interface down." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c" ], "versions": [ { "version": "ece593fc9c00741b682869d3f3dc584d37b7c9df", "lessThan": "05968b6dd0ffc65d7386608b11a11fb4fdfc9f36", "status": "affected", "versionType": "git" }, { "version": "a3ff23f7c3f0e13f718900803e090fd3997d6bc9", "lessThan": "6abcdc9a73274052a9e96a1926994ecf9aedad82", "status": "affected", "versionType": "git" }, { "version": "07c9c26e37542486e34d767505e842f48f29c3f6", "lessThan": "db3667c9bbfbbf5de98e6c9542f7e03fb5243286", "status": "affected", "versionType": "git" }, { "version": "66600fac7a984dea4ae095411f644770b2561ede", "lessThan": "9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e2", "status": "affected", "versionType": "git" }, { "version": "66600fac7a984dea4ae095411f644770b2561ede", "lessThan": "4c49f38e20a57f8abaebdf95b369295b153d1f8e", "status": "affected", "versionType": "git" }, { "version": "58d23d835eb498336716cca55b5714191a309286", "status": "affected", "versionType": "git" }, { "version": "5.15.171", "lessThan": "5.15.209", "status": "affected", "versionType": "semver" }, { "version": "6.1.116", "lessThan": "6.1.167", "status": "affected", "versionType": "semver" }, { "version": "6.6.60", "lessThan": "6.6.68", "status": "affected", "versionType": "semver" }, { "version": "6.11.7", "lessThan": "6.12", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c" ], "versions": [ { "version": "6.12", "status": "affected" }, { "version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.68", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.7", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.171", "versionEndExcluding": "5.15.209" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.116", "versionEndExcluding": "6.1.167" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.60", "versionEndExcluding": "6.6.68" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11.7" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/05968b6dd0ffc65d7386608b11a11fb4fdfc9f36" }, { "url": "https://git.kernel.org/stable/c/6abcdc9a73274052a9e96a1926994ecf9aedad82" }, { "url": "https://git.kernel.org/stable/c/db3667c9bbfbbf5de98e6c9542f7e03fb5243286" }, { "url": "https://git.kernel.org/stable/c/9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e2" }, { "url": "https://git.kernel.org/stable/c/4c49f38e20a57f8abaebdf95b369295b153d1f8e" } ], "title": "net: stmmac: fix TSO DMA API usage causing oops", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-56719", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T19:58:24.752519Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:07:06.268Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-07-14T12:38:40.467Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ] } ] } }