CVE-2024-40945

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-40945
In the Linux kernel, the following vulnerability has been resolved: iommu: Return right value in iommu_sva_bind_device() iommu_sva_bind_device() should return either a sva bond handle or an ERR_PTR value in error cases. Existing drivers (idxd and uacce) only check the return value with IS_ERR(). This could potentially lead to a kernel NULL pointer dereference issue if the function returns NULL instead of an error pointer. In reality, this doesn't cause any problems because iommu_sva_bind_device() only returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA. In this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will return an error, and the device drivers won't call iommu_sva_bind_device() at all.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2973b8e7d127754de9013177c41c0b5547406998 Patch
https://git.kernel.org/stable/c/61a96da9649a6b6a1a5d5bde9374b045fdb5c12e Patch
https://git.kernel.org/stable/c/6325eab6c108fed27f60ff51852e3eac0ba23f3f
https://git.kernel.org/stable/c/700f564758882db7c039dfba9443fe762561a3f8 Patch
https://git.kernel.org/stable/c/7388ae6f26c0ba95f70cc96bf9c5d5cb06c908b6 Patch
https://git.kernel.org/stable/c/89e8a2366e3bce584b6c01549d5019c5cda1205e Patch
https://git.kernel.org/stable/c/cf34f8f66982a36e5cba0d05781b21ec9606b91e Patch
https://git.kernel.org/stable/c/2973b8e7d127754de9013177c41c0b5547406998 Patch
https://git.kernel.org/stable/c/61a96da9649a6b6a1a5d5bde9374b045fdb5c12e Patch
https://git.kernel.org/stable/c/700f564758882db7c039dfba9443fe762561a3f8 Patch
https://git.kernel.org/stable/c/7388ae6f26c0ba95f70cc96bf9c5d5cb06c908b6 Patch
https://git.kernel.org/stable/c/89e8a2366e3bce584b6c01549d5019c5cda1205e Patch
https://git.kernel.org/stable/c/cf34f8f66982a36e5cba0d05781b21ec9606b91e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
History

21 Feb 2025, 14:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/6325eab6c108fed27f60ff51852e3eac0ba23f3f -

03 Feb 2025, 15:38

Type Values Removed Values Added
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/2973b8e7d127754de9013177c41c0b5547406998 - () https://git.kernel.org/stable/c/2973b8e7d127754de9013177c41c0b5547406998 - Patch
References () https://git.kernel.org/stable/c/61a96da9649a6b6a1a5d5bde9374b045fdb5c12e - () https://git.kernel.org/stable/c/61a96da9649a6b6a1a5d5bde9374b045fdb5c12e - Patch
References () https://git.kernel.org/stable/c/700f564758882db7c039dfba9443fe762561a3f8 - () https://git.kernel.org/stable/c/700f564758882db7c039dfba9443fe762561a3f8 - Patch
References () https://git.kernel.org/stable/c/7388ae6f26c0ba95f70cc96bf9c5d5cb06c908b6 - () https://git.kernel.org/stable/c/7388ae6f26c0ba95f70cc96bf9c5d5cb06c908b6 - Patch
References () https://git.kernel.org/stable/c/89e8a2366e3bce584b6c01549d5019c5cda1205e - () https://git.kernel.org/stable/c/89e8a2366e3bce584b6c01549d5019c5cda1205e - Patch
References () https://git.kernel.org/stable/c/cf34f8f66982a36e5cba0d05781b21ec9606b91e - () https://git.kernel.org/stable/c/cf34f8f66982a36e5cba0d05781b21ec9606b91e - Patch
First Time Linux linux Kernel
Linux

21 Nov 2024, 09:31

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/2973b8e7d127754de9013177c41c0b5547406998 - () https://git.kernel.org/stable/c/2973b8e7d127754de9013177c41c0b5547406998 -
References () https://git.kernel.org/stable/c/61a96da9649a6b6a1a5d5bde9374b045fdb5c12e - () https://git.kernel.org/stable/c/61a96da9649a6b6a1a5d5bde9374b045fdb5c12e -
References () https://git.kernel.org/stable/c/700f564758882db7c039dfba9443fe762561a3f8 - () https://git.kernel.org/stable/c/700f564758882db7c039dfba9443fe762561a3f8 -
References () https://git.kernel.org/stable/c/7388ae6f26c0ba95f70cc96bf9c5d5cb06c908b6 - () https://git.kernel.org/stable/c/7388ae6f26c0ba95f70cc96bf9c5d5cb06c908b6 -
References () https://git.kernel.org/stable/c/89e8a2366e3bce584b6c01549d5019c5cda1205e - () https://git.kernel.org/stable/c/89e8a2366e3bce584b6c01549d5019c5cda1205e -
References () https://git.kernel.org/stable/c/cf34f8f66982a36e5cba0d05781b21ec9606b91e - () https://git.kernel.org/stable/c/cf34f8f66982a36e5cba0d05781b21ec9606b91e -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: iommu: Devuelve el valor correcto en iommu_sva_bind_device() iommu_sva_bind_device() debería devolver un identificador de enlace sva o un valor ERR_PTR en casos de error. Los controladores existentes (idxd y uacce) solo verifican el valor de retorno con IS_ERR(). Esto podría provocar un problema de desreferencia del puntero NULL del kernel si la función devuelve NULL en lugar de un puntero de error. En realidad, esto no causa ningún problema porque iommu_sva_bind_device() solo devuelve NULL cuando el kernel no está configurado con CONFIG_IOMMU_SVA. En este caso, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) devolverá un error y los controladores del dispositivo no llamarán a iommu_sva_bind_device() en absoluto.

12 Jul 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-12 13:15

Updated : 2025-02-21 14:15

NVD link : CVE-2024-40945

Mitre link : CVE-2024-40945

CVE.ORG link : CVE-2024-40945

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference