{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-44984", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T05:34:56.670Z", "datePublished": "2024-09-04T19:54:33.487Z", "dateUpdated": "2026-08-05T11:37:26.610Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:26.610Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix double DMA unmapping for XDP_REDIRECT\n\nRemove the dma_unmap_page_attrs() call in the driver's XDP_REDIRECT\ncode path. This should have been removed when we let the page pool\nhandle the DMA mapping. This bug causes the warning:\n\nWARNING: CPU: 7 PID: 59 at drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100\nCPU: 7 PID: 59 Comm: ksoftirqd/7 Tainted: G W 6.8.0-1010-gcp #11-Ubuntu\nHardware name: Dell Inc. PowerEdge R7525/0PYVT1, BIOS 2.15.2 04/02/2024\nRIP: 0010:iommu_dma_unmap_page+0xd5/0x100\nCode: 89 ee 48 89 df e8 cb f2 69 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff 45 31 c0 e9 ab 17 71 00 <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9\nRSP: 0018:ffffab1fc0597a48 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff99ff838280c8 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffab1fc0597a78 R08: 0000000000000002 R09: ffffab1fc0597c1c\nR10: ffffab1fc0597cd3 R11: ffff99ffe375acd8 R12: 00000000e65b9000\nR13: 0000000000000050 R14: 0000000000001000 R15: 0000000000000002\nFS: 0000000000000000(0000) GS:ffff9a06efb80000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000565c34c37210 CR3: 00000005c7e3e000 CR4: 0000000000350ef0\n? show_regs+0x6d/0x80\n? __warn+0x89/0x150\n? iommu_dma_unmap_page+0xd5/0x100\n? report_bug+0x16a/0x190\n? handle_bug+0x51/0xa0\n? exc_invalid_op+0x18/0x80\n? iommu_dma_unmap_page+0xd5/0x100\n? iommu_dma_unmap_page+0x35/0x100\ndma_unmap_page_attrs+0x55/0x220\n? bpf_prog_4d7e87c0d30db711_xdp_dispatcher+0x64/0x9f\nbnxt_rx_xdp+0x237/0x520 [bnxt_en]\nbnxt_rx_pkt+0x640/0xdd0 [bnxt_en]\n__bnxt_poll_work+0x1a1/0x3d0 [bnxt_en]\nbnxt_poll+0xaa/0x1e0 [bnxt_en]\n__napi_poll+0x33/0x1e0\nnet_rx_action+0x18a/0x2f0" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The defect is triggered entirely from the NIC receive path (`bnxt_poll` → `bnxt_rx_pkt` → `bnxt_rx_xdp`) by frames arriving on the wire, with no local access required. The canonical XDP_REDIRECT deployment is an internet-facing load balancer, router, or AF_XDP dataplane, so any remote host that can route packets to the interface reaches the vulnerable code.\nAC:L - Every packet the XDP program redirects deterministically executes the erroneous `dma_unmap_page_attrs()` on the page-pool-owned mapping — there is no race, no memory-layout requirement, and no probabilistic gate. The attacker further controls traffic volume and timing, which is exactly what drives IOVA turnover and makes the freed IOVA get reassigned to a live mapping.\nPR:N - The code runs in NAPI softirq context on packet reception before any authentication, authorization, or socket ownership check; the packet source is an arbitrary unauthenticated remote host. No kernel privilege, capability, or local account is involved in triggering it.\nUI:N - No victim action is needed — the bug fires automatically during normal packet processing as soon as a redirected frame arrives. No user must open, mount, connect to, or interact with anything.\nS:C - The defect corrupts the DMA/IOMMU mapping lifetime itself: the NIC is left holding an IOVA it no longer owns and the driver tears down mappings owned by other DMA users in the same IOMMU domain. The IOMMU is the authority that confines device DMA to authorized host memory, so the impacted resources lie outside the driver's own security scope — a DMA/IOMMU boundary bypass.\nC:H - In XDP mode `bp->rx_dir` is `DMA_BIDIRECTIONAL`, so once the freed IOVA is reassigned the NIC can read host memory belonging to an unrelated DMA mapping and transmit it onto the network. The SWIOTLB variant double-frees a bounce slot, letting one mapping's contents be handed to another — arbitrary cross-buffer disclosure.\nI:H - The device writes attacker-controlled packet payload through a stale IOVA into memory that now belongs to a different DMA mapping, and the second `dma_unmap_page_attrs()` destroys another mapping's page-table entries. That is an attacker-influenced write primitive into memory outside the driver's authorized region.\nA:H - The immediate observed effect is a `WARN_ON` in `iommu_dma_unmap_page()` with kernel taint — fatal under `panic_on_warn` — and the underlying mapping corruption produces IOMMU/DMAR fault storms, NIC reset and link loss, and corruption of unrelated devices' in-flight DMA. It can be sustained indefinitely by a remote attacker simply sending traffic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c" ], "versions": [ { "version": "578fcfd26e2a1d0e687b347057959228567e2af8", "lessThan": "fa4e6ae38574d0fc5596272bee64727d8ab7052b", "status": "affected", "versionType": "git" }, { "version": "578fcfd26e2a1d0e687b347057959228567e2af8", "lessThan": "95a305ba259b685780ed62ea2295aa2feb2d6c0c", "status": "affected", "versionType": "git" }, { "version": "578fcfd26e2a1d0e687b347057959228567e2af8", "lessThan": "8baeef7616d5194045c5a6b97fd1246b87c55b13", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c" ], "versions": [ { "version": "6.6", "status": "affected" }, { "version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.48", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.7", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.48" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.10.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/fa4e6ae38574d0fc5596272bee64727d8ab7052b" }, { "url": "https://git.kernel.org/stable/c/95a305ba259b685780ed62ea2295aa2feb2d6c0c" }, { "url": "https://git.kernel.org/stable/c/8baeef7616d5194045c5a6b97fd1246b87c55b13" } ], "title": "bnxt_en: Fix double DMA unmapping for XDP_REDIRECT", "x_generator": { "engine": "bippy-1.2.0" } } } }