{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-44994", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T05:34:56.672Z", "datePublished": "2024-09-04T19:54:40.214Z", "dateUpdated": "2026-08-05T11:37:33.085Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:33.085Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Restore lost return in iommu_report_device_fault()\n\nWhen iommu_report_device_fault gets called with a partial fault it is\nsupposed to collect the fault into the group and then return.\n\nInstead the return was accidently deleted which results in trying to\nprocess the fault and an eventual crash.\n\nDeleting the return was a typo, put it back." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached through IOMMU PRI/PPR page requests generated by a device under local control — an unprivileged process driving an SVA-capable accelerator (`/dev/dsa/wq*`, `/dev/kfd`) or a guest VM with an assigned PRI device whose PASID table it owns. No network or physical access is required.\nAC:L - The very first page request with the LPIG/last-page bit clear deterministically falls through into the group path; there is no race, timing window, or memory-layout precondition for the double free. The attacker controls the device's page-request stream, and multi-request PRG groups are ordinary PRI behaviour.\nPR:L - Only access to an SVA/PASID-capable device node is needed — idxd and amdkfd char devices are intentionally exposed to unprivileged userspace for shared-virtual-addressing workloads — or ordinary guest privileges on a VM with an assigned device. No root or CAP_SYS_ADMIN is required.\nUI:N - The fault is generated by the attacker's own DMA/descriptor submission and handled in the IOMMU fault worker; no action by any other user or administrator is involved.\nS:C - The corruption is driven entirely by device-originated PRI input, so a guest-assigned or malicious PRI-capable peripheral escapes the IOMMU's device-isolation authority into host kernel memory; the code additionally acks an incomplete PRG back to the device, manipulating the DMA-isolation control plane itself.\nC:H - The double-freed `iopf_group` and the prematurely freed `iommu_fault_param` — still reachable via `dev->iommu->fault_param` and `queue->devices` — give an attacker who reclaims the slab full read access to kernel heap contents, including the `dev`/`ops` pointers dereferenced on the next fault.\nI:H - A double free in a general-purpose kmalloc cache plus `list_add()` writes into a reallocated `iommu_fault_param` yield arbitrary-write and cross-cache primitives, and `ops->page_response()` is called through pointers read from the freed object, enabling control-flow hijack and privilege escalation.\nA:H - The commit itself states the fall-through results in \"an eventual crash\"; the double free, refcount underflow (refcount_t saturation warning), and subsequent use-after-free reliably oops or panic the kernel, and on `abort_group` it calls `kfree()` on a kernel stack address." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/iommu/io-pgfault.c" ], "versions": [ { "version": "3dfa64aecbafc288216b2790438d395add192c30", "lessThan": "cc6bc2ab1663ec9353636416af22452b078510e9", "status": "affected", "versionType": "git" }, { "version": "3dfa64aecbafc288216b2790438d395add192c30", "lessThan": "fca5b78511e98bdff2cdd55c172b23200a7b3404", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/iommu/io-pgfault.c" ], "versions": [ { "version": "6.9", "status": "affected" }, { "version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.7", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.10.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cc6bc2ab1663ec9353636416af22452b078510e9" }, { "url": "https://git.kernel.org/stable/c/fca5b78511e98bdff2cdd55c172b23200a7b3404" } ], "title": "iommu: Restore lost return in iommu_report_device_fault()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-04T20:19:24.535460Z", "id": "CVE-2024-44994", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T20:19:36.614Z" } } ] } }