In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix protection fault in iommufd_test_syz_conv_iova
Syzkaller reported the following bug:
general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]
Call Trace:
lock_acquire
lock_acquire+0x1ce/0x4f0
down_read+0x93/0x4a0
iommufd_test_syz_conv_iova+0x56/0x1f0
iommufd_test_access_rw.isra.0+0x2ec/0x390
iommufd_test+0x1058/0x1e30
iommufd_fops_ioctl+0x381/0x510
vfs_ioctl
__do_sys_ioctl
__se_sys_ioctl
__x64_sys_ioctl+0x170/0x1e0
do_syscall_x64
do_syscall_64+0x71/0x140
This is because the new iommufd_access_change_ioas() sets access->ioas to
NULL during its process, so the lock might be gone in a concurrent racing
context.
Fix this by doing the same access->ioas sanity as iommufd_access_rw() and
iommufd_access_pin_pages() functions do.
References
Configurations
Configuration 1 (hide)
|
History
04 Apr 2025, 14:04
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/cf7c2789822db8b5efa34f5ebcf1621bc0008d48 - Patch | |
| References | () https://git.kernel.org/stable/c/fc719ecbca45c9c046640d72baddba3d83e0bc0b - Patch | |
| References | () https://git.kernel.org/stable/c/fd4d5cd7a2e8f08357c9bfc0905957cffe8ce568 - Patch | |
| First Time |
Linux linux Kernel
Linux |
21 Nov 2024, 09:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/cf7c2789822db8b5efa34f5ebcf1621bc0008d48 - | |
| References | () https://git.kernel.org/stable/c/fc719ecbca45c9c046640d72baddba3d83e0bc0b - |
07 Nov 2024, 19:35
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-120 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
10 Oct 2024, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
04 Apr 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-04 09:15
Updated : 2025-04-04 14:04
NVD link : CVE-2024-26785
Mitre link : CVE-2024-26785
CVE.ORG link : CVE-2024-26785
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')