// For flags

CVE-2024-36925

swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y

Severity Score

5.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved:

swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y

Using restricted DMA pools (CONFIG_DMA_RESTRICTED_POOL=y) in conjunction
with dynamic SWIOTLB (CONFIG_SWIOTLB_DYNAMIC=y) leads to the following
crash when initialising the restricted pools at boot-time:

| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
| Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
| pc : rmem_swiotlb_device_init+0xfc/0x1ec
| lr : rmem_swiotlb_device_init+0xf0/0x1ec
| Call trace:
| rmem_swiotlb_device_init+0xfc/0x1ec
| of_reserved_mem_device_init_by_idx+0x18c/0x238
| of_dma_configure_id+0x31c/0x33c
| platform_dma_configure+0x34/0x80

faddr2line reveals that the crash is in the list validation code:

include/linux/list.h:83
include/linux/rculist.h:79
include/linux/rculist.h:106
kernel/dma/swiotlb.c:306
kernel/dma/swiotlb.c:1695

because add_mem_pool() is trying to list_add_rcu() to a NULL
'mem->pools'.

Fix the crash by initialising the 'mem->pools' list_head in
rmem_swiotlb_device_init() before calling add_mem_pool().

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: swiotlb: inicializa el grupo restringido list_head cuando SWIOTLB_DYNAMIC=y El uso de grupos DMA restringidos (CONFIG_DMA_RESTRICTED_POOL=y) junto con SWIOTLB dinámico (CONFIG_SWIOTLB_DYNAMIC=y) provoca el siguiente bloqueo al inicializar el grupo restringido grupos en el momento del arranque: | No se puede manejar la desreferencia del puntero NULL del kernel en la dirección virtual 0000000000000008 | Error interno: Ups: 0000000096000005 [#1] SMP ANTICIPADO | ordenador personal: rmem_swiotlb_device_init+0xfc/0x1ec | lr: rmem_swiotlb_device_init+0xf0/0x1ec | Rastreo de llamadas: | rmem_swiotlb_device_init+0xfc/0x1ec | of_reserved_mem_device_init_by_idx+0x18c/0x238 | of_dma_configure_id+0x31c/0x33c | platform_dma_configure+0x34/0x80 faddr2line revela que el bloqueo está en el código de validación de la lista: include/linux/list.h:83 include/linux/rculist.h:79 include/linux/rculist.h:106 kernel/dma/swiotlb. c:306 kernel/dma/swiotlb.c:1695 porque add_mem_pool() está intentando list_add_rcu() a un NULL 'mem->pools'. Solucione el problema inicializando el list_head 'mem->pools' en rmem_swiotlb_device_init() antes de llamar a add_mem_pool().

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-05-30 CVE Reserved
  • 2024-05-30 CVE Published
  • 2024-06-11 EPSS Updated
  • 2024-11-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-476: NULL Pointer Dereference
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 6.6 < 6.6.31
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.6 < 6.6.31"
en
Affected
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 6.6 < 6.8.10
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.6 < 6.8.10"
en
Affected
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 6.6 < 6.9
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.6 < 6.9"
en
Affected