{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-27409", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-25T13:47:42.682Z", "datePublished": "2024-05-17T11:50:39.756Z", "dateUpdated": "2026-08-05T11:29:39.981Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:39.981Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup\n\nThe Linked list element and pointer are not stored in the same memory as\nthe HDMA controller register. If the doorbell register is toggled before\nthe full write of the linked list a race condition error will occur.\nIn remote setup we can only use a readl to the memory to assure the full\nwrite has occurred." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The affected code is a host-side dmaengine driver for a DesignWare HDMA engine resident in a remote PCIe endpoint; it is exercised by local I/O against the client device, with no network-facing protocol handler anywhere on the path.\nAC:L - The driver omits the required LL/doorbell ordering entirely rather than losing a rare timing window, so the commit states the race \"will occur\" during ordinary remote transfers; an attacker issuing repeated transfers (and loading the PCIe link to delay the posted MWr TLPs) triggers it reliably.\nPR:L - An unprivileged local user with access to the client device that moves data over the remote HDMA channel can drive the transfers that hit the race; no root or real capability is required.\nUI:N - The race is hit by the attacker's own device I/O; no victim action or separate user step is needed.\nS:U - The corruption occurs in host kernel memory under the same security authority as the driver; IOMMU/DMA translation boundaries are still applied to the transfer, so no boundary is crossed.\nC:H - A stale or half-updated `sar` in the reused LL region makes the engine read host memory belonging to a previously mapped, now-freed and reused buffer and copy it into the current destination, giving disclosure of arbitrary kernel/other-process memory contents.\nI:H - A stale or half-updated 64-bit `dar` makes the endpoint DMA-write into host physical memory that is no longer part of the transfer, an uncontrolled write primitive into kernel or other-process pages.\nA:H - Wild-address DMA and malformed descriptors cause DMA aborts, IOMMU faults and kernel memory corruption, resulting in oopses, panics and stalled DMA channels." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/dma/dw-edma/dw-hdma-v0-core.c" ], "versions": [ { "version": "e74c39573d35e9ac441090ff8183aa3dc2540649", "lessThan": "227ef58a9b0c372efba422e8886a8015a1509eba", "status": "affected", "versionType": "git" }, { "version": "e74c39573d35e9ac441090ff8183aa3dc2540649", "lessThan": "17be6f5cb223f22e4733ed8fe8b2247cbb677716", "status": "affected", "versionType": "git" }, { "version": "e74c39573d35e9ac441090ff8183aa3dc2540649", "lessThan": "712a92a48158e02155b4b6b21e03a817f78c9b7e", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/dma/dw-edma/dw-hdma-v0-core.c" ], "versions": [ { "version": "6.5", "status": "affected" }, { "version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.21", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.9", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.7.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/227ef58a9b0c372efba422e8886a8015a1509eba" }, { "url": "https://git.kernel.org/stable/c/17be6f5cb223f22e4733ed8fe8b2247cbb677716" }, { "url": "https://git.kernel.org/stable/c/712a92a48158e02155b4b6b21e03a817f78c9b7e" } ], "title": "dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-27409", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-20T17:32:55.652133Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:46:17.954Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:34:52.290Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/227ef58a9b0c372efba422e8886a8015a1509eba", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/17be6f5cb223f22e4733ed8fe8b2247cbb677716", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/712a92a48158e02155b4b6b21e03a817f78c9b7e", "tags": [ "x_transferred" ] } ] } ] } }