{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-47730", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.957Z", "datePublished": "2024-10-21T12:14:02.378Z", "dateUpdated": "2026-08-05T11:39:47.501Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:47.501Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - inject error before stopping queue\n\nThe master ooo cannot be completely closed when the\naccelerator core reports memory error. Therefore, the driver\nneeds to inject the qm error to close the master ooo. Currently,\nthe qm error is injected after stopping queue, memory may be\nreleased immediately after stopping queue, causing the device to\naccess the released memory. Therefore, error is injected to close master\nooo before stopping queue to ensure that the device does not access\nthe released memory." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is the PF reset path of a local PCIe crypto accelerator (drivers/crypto/hisilicon/qm.c), reached only via the device's abnormal interrupt handler or the PCIe AER slot-reset callback on the host itself. The affected principal is a local user/process holding accelerator queues through uacce or the kernel crypto API; there is no remote or adjacent protocol involved.\nAC:H - The defective ordering only bites when `err_status.is_dev_ecc_mbit`/`is_qm_ecc_mbit` is set, i.e. after an uncorrectable ECC multi-bit fault in the accelerator's internal SRAM (`ecc_2bits_mask`) — a spontaneous hardware memory error the attacker cannot induce, since the injection registers at BAR offsets ≥0x100000 are outside the ≤8 KB uacce MMIO mapping. The attacker must additionally hit the narrow window between `hisi_qm_stop()` freeing queue memory and the later master-ooo close, and the path is limited to pre-V3 (Kunpeng 920) hardware.\nPR:L - An unprivileged local user with a uacce queue (/dev/hisi_zip-N, /dev/hisi_sec2-N, etc.) or ordinary use of the accelerator through the kernel crypto API is enough to be in the affected state and to control when the queue memory is released; no CAP_SYS_ADMIN or root is needed to hold a queue.\nUI:N - The controller reset is scheduled automatically from `qm_abnormal_irq()`/AER without any user action, and the memory release follows from normal queue teardown. No victim must open a file, mount a filesystem, or perform any other action.\nS:U - The stale DMA corrupts kernel/DMA memory managed by the same kernel that contains the vulnerable driver; no VM, IOMMU, or sandbox boundary is crossed — where an IOMMU is active the stale accesses fault rather than escaping a boundary.\nC:H - The still-active AXI master performs out-of-order reads of released memory that has been returned to the allocator and reused by unrelated kernel or process allocations, and those reads can be reflected back into user-visible completion/output buffers — an effective use-after-free read primitive over arbitrary reallocated pages.\nI:H - The device continues writing out-of-order results into freed pages after `hisi_qm_stop()`/`qm_clear_queues()`, so accelerator output whose content is influenced by the in-flight job lands in memory now owned by other kernel objects — a DMA use-after-free write giving heap corruption and a path to control-flow hijack.\nA:H - DMA into freed and reallocated memory reliably causes kernel corruption, oops or panic; additionally, when the master ooo cannot be closed, `qm_master_ooo_check()` times out with \"Bus lock! Please reset system.\", the controller reset fails, and the accelerator is permanently isolated." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/crypto/hisilicon/qm.c" ], "versions": [ { "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7", "lessThan": "85e81103033324d7a271dafb584991da39554a89", "status": "affected", "versionType": "git" }, { "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7", "lessThan": "801d64177faaec184cee1e1aa4d8487df1364a54", "status": "affected", "versionType": "git" }, { "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7", "lessThan": "98d3be34c9153eceadb56de50d9f9347e88d86e4", "status": "affected", "versionType": "git" }, { "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7", "lessThan": "aa3e0db35a60002fb34ef0e4ad203aa59fd00203", "status": "affected", "versionType": "git" }, { "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7", "lessThan": "f8024f12752e32ffbbf59e1c09d949f977ff743f", "status": "affected", "versionType": "git" }, { "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7", "lessThan": "c5f5b813e546f7fe133539c3d7a5086cc8dd2aa1", "status": "affected", "versionType": "git" }, { "version": "6c6dd5802c2d6769fa589c0e8de54299def199a7", "lessThan": "b04f06fc0243600665b3b50253869533b7938468", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/crypto/hisilicon/qm.c" ], "versions": [ { "version": "5.8", "status": "affected" }, { "version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.235", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.54", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.13", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.2", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.235" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.174" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.54" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.10.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.11.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/85e81103033324d7a271dafb584991da39554a89" }, { "url": "https://git.kernel.org/stable/c/801d64177faaec184cee1e1aa4d8487df1364a54" }, { "url": "https://git.kernel.org/stable/c/98d3be34c9153eceadb56de50d9f9347e88d86e4" }, { "url": "https://git.kernel.org/stable/c/aa3e0db35a60002fb34ef0e4ad203aa59fd00203" }, { "url": "https://git.kernel.org/stable/c/f8024f12752e32ffbbf59e1c09d949f977ff743f" }, { "url": "https://git.kernel.org/stable/c/c5f5b813e546f7fe133539c3d7a5086cc8dd2aa1" }, { "url": "https://git.kernel.org/stable/c/b04f06fc0243600665b3b50253869533b7938468" } ], "title": "crypto: hisilicon/qm - inject error before stopping queue", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-47730", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-21T13:00:38.367655Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T13:04:16.049Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:21:26.550Z" } } ] } }