CVE-2024-26745 (GCVE-0-2024-26745)

Vulnerability from cvelistv5 – Published: 2024-04-04 08:20 – Updated: 2025-05-04 12:54
VLAI?
Title
powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV When kdump kernel tries to copy dump data over SR-IOV, LPAR panics due to NULL pointer exception: Kernel attempted to read user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000000 Faulting instruction address: 0xc000000020847ad4 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: mlx5_core(+) vmx_crypto pseries_wdt papr_scm libnvdimm mlxfw tls psample sunrpc fuse overlay squashfs loop CPU: 12 PID: 315 Comm: systemd-udevd Not tainted 6.4.0-Test102+ #12 Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_008) hv:phyp pSeries NIP: c000000020847ad4 LR: c00000002083b2dc CTR: 00000000006cd18c REGS: c000000029162ca0 TRAP: 0300 Not tainted (6.4.0-Test102+) MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 48288244 XER: 00000008 CFAR: c00000002083b2d8 DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 1 ... NIP _find_next_zero_bit+0x24/0x110 LR bitmap_find_next_zero_area_off+0x5c/0xe0 Call Trace: dev_printk_emit+0x38/0x48 (unreliable) iommu_area_alloc+0xc4/0x180 iommu_range_alloc+0x1e8/0x580 iommu_alloc+0x60/0x130 iommu_alloc_coherent+0x158/0x2b0 dma_iommu_alloc_coherent+0x3c/0x50 dma_alloc_attrs+0x170/0x1f0 mlx5_cmd_init+0xc0/0x760 [mlx5_core] mlx5_function_setup+0xf0/0x510 [mlx5_core] mlx5_init_one+0x84/0x210 [mlx5_core] probe_one+0x118/0x2c0 [mlx5_core] local_pci_probe+0x68/0x110 pci_call_probe+0x68/0x200 pci_device_probe+0xbc/0x1a0 really_probe+0x104/0x540 __driver_probe_device+0xb4/0x230 driver_probe_device+0x54/0x130 __driver_attach+0x158/0x2b0 bus_for_each_dev+0xa8/0x130 driver_attach+0x34/0x50 bus_add_driver+0x16c/0x300 driver_register+0xa4/0x1b0 __pci_register_driver+0x68/0x80 mlx5_init+0xb8/0x100 [mlx5_core] do_one_initcall+0x60/0x300 do_init_module+0x7c/0x2b0 At the time of LPAR dump, before kexec hands over control to kdump kernel, DDWs (Dynamic DMA Windows) are scanned and added to the FDT. For the SR-IOV case, default DMA window "ibm,dma-window" is removed from the FDT and DDW added, for the device. Now, kexec hands over control to the kdump kernel. When the kdump kernel initializes, PCI busses are scanned and IOMMU group/tables created, in pci_dma_bus_setup_pSeriesLP(). For the SR-IOV case, there is no "ibm,dma-window". The original commit: b1fc44eaa9ba, fixes the path where memory is pre-mapped (direct mapped) to the DDW. When TCEs are direct mapped, there is no need to initialize IOMMU tables. iommu_table_setparms_lpar() only considers "ibm,dma-window" property when initiallizing IOMMU table. In the scenario where TCEs are dynamically allocated for SR-IOV, newly created IOMMU table is not initialized. Later, when the device driver tries to enter TCEs for the SR-IOV device, NULL pointer execption is thrown from iommu_area_alloc(). The fix is to initialize the IOMMU table with DDW property stored in the FDT. There are 2 points to remember: 1. For the dedicated adapter, kdump kernel would encounter both default and DDW in FDT. In this case, DDW property is used to initialize the IOMMU table. 2. A DDW could be direct or dynamic mapped. kdump kernel would initialize IOMMU table and mark the existing DDW as "dynamic". This works fine since, at the time of table initialization, iommu_table_clear() makes some space in the DDW, for some predefined number of TCEs which are needed for kdump to succeed.
Severity ?
4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d , < 7eb95e0af5c9c2e6fad50356eaf32d216d0e7bc3 (git)
Affected: b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d , < d4d1e4b1513d975961de7bb4f75e450a92d65ebf (git)
Affected: b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d , < 5da6d306f315344af1ca2eff4bd9b10b130f0c28 (git)
Affected: b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d , < 09a3c1e46142199adcee372a420b024b4fc61051 (git)
Affected: b9f08b2649dddd4eb0698cb428b173bb01dd2fc5 (git)
Affected: 58942f672c6d04b6a3cd7866cb459671df881538 (git)
Create a notification for this product.
    Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.81 , ≤ 6.1.* (semver)
Unaffected: 6.6.21 , ≤ 6.6.* (semver)
Unaffected: 6.7.9 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-04T15:11:41.135555Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-31T18:11:38.179Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.198Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7eb95e0af5c9c2e6fad50356eaf32d216d0e7bc3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d4d1e4b1513d975961de7bb4f75e450a92d65ebf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5da6d306f315344af1ca2eff4bd9b10b130f0c28"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/09a3c1e46142199adcee372a420b024b4fc61051"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/platforms/pseries/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7eb95e0af5c9c2e6fad50356eaf32d216d0e7bc3",
              "status": "affected",
              "version": "b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d",
              "versionType": "git"
            },
            {
              "lessThan": "d4d1e4b1513d975961de7bb4f75e450a92d65ebf",
              "status": "affected",
              "version": "b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d",
              "versionType": "git"
            },
            {
              "lessThan": "5da6d306f315344af1ca2eff4bd9b10b130f0c28",
              "status": "affected",
              "version": "b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d",
              "versionType": "git"
            },
            {
              "lessThan": "09a3c1e46142199adcee372a420b024b4fc61051",
              "status": "affected",
              "version": "b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b9f08b2649dddd4eb0698cb428b173bb01dd2fc5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "58942f672c6d04b6a3cd7866cb459671df881538",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/platforms/pseries/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.81",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.21",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV\n\nWhen kdump kernel tries to copy dump data over SR-IOV, LPAR panics due\nto NULL pointer exception:\n\n  Kernel attempted to read user page (0) - exploit attempt? (uid: 0)\n  BUG: Kernel NULL pointer dereference on read at 0x00000000\n  Faulting instruction address: 0xc000000020847ad4\n  Oops: Kernel access of bad area, sig: 11 [#1]\n  LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\n  Modules linked in: mlx5_core(+) vmx_crypto pseries_wdt papr_scm libnvdimm mlxfw tls psample sunrpc fuse overlay squashfs loop\n  CPU: 12 PID: 315 Comm: systemd-udevd Not tainted 6.4.0-Test102+ #12\n  Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_008) hv:phyp pSeries\n  NIP:  c000000020847ad4 LR: c00000002083b2dc CTR: 00000000006cd18c\n  REGS: c000000029162ca0 TRAP: 0300   Not tainted  (6.4.0-Test102+)\n  MSR:  800000000280b033 \u003cSF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE\u003e  CR: 48288244  XER: 00000008\n  CFAR: c00000002083b2d8 DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 1\n  ...\n  NIP _find_next_zero_bit+0x24/0x110\n  LR  bitmap_find_next_zero_area_off+0x5c/0xe0\n  Call Trace:\n    dev_printk_emit+0x38/0x48 (unreliable)\n    iommu_area_alloc+0xc4/0x180\n    iommu_range_alloc+0x1e8/0x580\n    iommu_alloc+0x60/0x130\n    iommu_alloc_coherent+0x158/0x2b0\n    dma_iommu_alloc_coherent+0x3c/0x50\n    dma_alloc_attrs+0x170/0x1f0\n    mlx5_cmd_init+0xc0/0x760 [mlx5_core]\n    mlx5_function_setup+0xf0/0x510 [mlx5_core]\n    mlx5_init_one+0x84/0x210 [mlx5_core]\n    probe_one+0x118/0x2c0 [mlx5_core]\n    local_pci_probe+0x68/0x110\n    pci_call_probe+0x68/0x200\n    pci_device_probe+0xbc/0x1a0\n    really_probe+0x104/0x540\n    __driver_probe_device+0xb4/0x230\n    driver_probe_device+0x54/0x130\n    __driver_attach+0x158/0x2b0\n    bus_for_each_dev+0xa8/0x130\n    driver_attach+0x34/0x50\n    bus_add_driver+0x16c/0x300\n    driver_register+0xa4/0x1b0\n    __pci_register_driver+0x68/0x80\n    mlx5_init+0xb8/0x100 [mlx5_core]\n    do_one_initcall+0x60/0x300\n    do_init_module+0x7c/0x2b0\n\nAt the time of LPAR dump, before kexec hands over control to kdump\nkernel, DDWs (Dynamic DMA Windows) are scanned and added to the FDT.\nFor the SR-IOV case, default DMA window \"ibm,dma-window\" is removed from\nthe FDT and DDW added, for the device.\n\nNow, kexec hands over control to the kdump kernel.\n\nWhen the kdump kernel initializes, PCI busses are scanned and IOMMU\ngroup/tables created, in pci_dma_bus_setup_pSeriesLP(). For the SR-IOV\ncase, there is no \"ibm,dma-window\". The original commit: b1fc44eaa9ba,\nfixes the path where memory is pre-mapped (direct mapped) to the DDW.\nWhen TCEs are direct mapped, there is no need to initialize IOMMU\ntables.\n\niommu_table_setparms_lpar() only considers \"ibm,dma-window\" property\nwhen initiallizing IOMMU table. In the scenario where TCEs are\ndynamically allocated for SR-IOV, newly created IOMMU table is not\ninitialized. Later, when the device driver tries to enter TCEs for the\nSR-IOV device, NULL pointer execption is thrown from iommu_area_alloc().\n\nThe fix is to initialize the IOMMU table with DDW property stored in the\nFDT. There are 2 points to remember:\n\n\t1. For the dedicated adapter, kdump kernel would encounter both\n\t   default and DDW in FDT. In this case, DDW property is used to\n\t   initialize the IOMMU table.\n\n\t2. A DDW could be direct or dynamic mapped. kdump kernel would\n\t   initialize IOMMU table and mark the existing DDW as\n\t   \"dynamic\". This works fine since, at the time of table\n\t   initialization, iommu_table_clear() makes some space in the\n\t   DDW, for some predefined number of TCEs which are needed for\n\t   kdump to succeed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T12:54:38.789Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7eb95e0af5c9c2e6fad50356eaf32d216d0e7bc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4d1e4b1513d975961de7bb4f75e450a92d65ebf"
        },
        {
          "url": "https://git.kernel.org/stable/c/5da6d306f315344af1ca2eff4bd9b10b130f0c28"
        },
        {
          "url": "https://git.kernel.org/stable/c/09a3c1e46142199adcee372a420b024b4fc61051"
        }
      ],
      "title": "powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26745",
    "datePublished": "2024-04-04T08:20:13.182Z",
    "dateReserved": "2024-02-19T14:20:24.168Z",
    "dateUpdated": "2025-05-04T12:54:38.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7eb95e0af5c9c2e6fad50356eaf32d216d0e7bc3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d4d1e4b1513d975961de7bb4f75e450a92d65ebf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5da6d306f315344af1ca2eff4bd9b10b130f0c28\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/09a3c1e46142199adcee372a420b024b4fc61051\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.198Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26745\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-04T15:11:41.135555Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:21.950Z\"}}], \"cna\": {\"title\": \"powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d\", \"lessThan\": \"7eb95e0af5c9c2e6fad50356eaf32d216d0e7bc3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d\", \"lessThan\": \"d4d1e4b1513d975961de7bb4f75e450a92d65ebf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d\", \"lessThan\": \"5da6d306f315344af1ca2eff4bd9b10b130f0c28\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d\", \"lessThan\": \"09a3c1e46142199adcee372a420b024b4fc61051\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/powerpc/platforms/pseries/iommu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.81\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.21\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/powerpc/platforms/pseries/iommu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7eb95e0af5c9c2e6fad50356eaf32d216d0e7bc3\"}, {\"url\": \"https://git.kernel.org/stable/c/d4d1e4b1513d975961de7bb4f75e450a92d65ebf\"}, {\"url\": \"https://git.kernel.org/stable/c/5da6d306f315344af1ca2eff4bd9b10b130f0c28\"}, {\"url\": \"https://git.kernel.org/stable/c/09a3c1e46142199adcee372a420b024b4fc61051\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV\\n\\nWhen kdump kernel tries to copy dump data over SR-IOV, LPAR panics due\\nto NULL pointer exception:\\n\\n  Kernel attempted to read user page (0) - exploit attempt? (uid: 0)\\n  BUG: Kernel NULL pointer dereference on read at 0x00000000\\n  Faulting instruction address: 0xc000000020847ad4\\n  Oops: Kernel access of bad area, sig: 11 [#1]\\n  LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\\n  Modules linked in: mlx5_core(+) vmx_crypto pseries_wdt papr_scm libnvdimm mlxfw tls psample sunrpc fuse overlay squashfs loop\\n  CPU: 12 PID: 315 Comm: systemd-udevd Not tainted 6.4.0-Test102+ #12\\n  Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_008) hv:phyp pSeries\\n  NIP:  c000000020847ad4 LR: c00000002083b2dc CTR: 00000000006cd18c\\n  REGS: c000000029162ca0 TRAP: 0300   Not tainted  (6.4.0-Test102+)\\n  MSR:  800000000280b033 \u003cSF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE\u003e  CR: 48288244  XER: 00000008\\n  CFAR: c00000002083b2d8 DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 1\\n  ...\\n  NIP _find_next_zero_bit+0x24/0x110\\n  LR  bitmap_find_next_zero_area_off+0x5c/0xe0\\n  Call Trace:\\n    dev_printk_emit+0x38/0x48 (unreliable)\\n    iommu_area_alloc+0xc4/0x180\\n    iommu_range_alloc+0x1e8/0x580\\n    iommu_alloc+0x60/0x130\\n    iommu_alloc_coherent+0x158/0x2b0\\n    dma_iommu_alloc_coherent+0x3c/0x50\\n    dma_alloc_attrs+0x170/0x1f0\\n    mlx5_cmd_init+0xc0/0x760 [mlx5_core]\\n    mlx5_function_setup+0xf0/0x510 [mlx5_core]\\n    mlx5_init_one+0x84/0x210 [mlx5_core]\\n    probe_one+0x118/0x2c0 [mlx5_core]\\n    local_pci_probe+0x68/0x110\\n    pci_call_probe+0x68/0x200\\n    pci_device_probe+0xbc/0x1a0\\n    really_probe+0x104/0x540\\n    __driver_probe_device+0xb4/0x230\\n    driver_probe_device+0x54/0x130\\n    __driver_attach+0x158/0x2b0\\n    bus_for_each_dev+0xa8/0x130\\n    driver_attach+0x34/0x50\\n    bus_add_driver+0x16c/0x300\\n    driver_register+0xa4/0x1b0\\n    __pci_register_driver+0x68/0x80\\n    mlx5_init+0xb8/0x100 [mlx5_core]\\n    do_one_initcall+0x60/0x300\\n    do_init_module+0x7c/0x2b0\\n\\nAt the time of LPAR dump, before kexec hands over control to kdump\\nkernel, DDWs (Dynamic DMA Windows) are scanned and added to the FDT.\\nFor the SR-IOV case, default DMA window \\\"ibm,dma-window\\\" is removed from\\nthe FDT and DDW added, for the device.\\n\\nNow, kexec hands over control to the kdump kernel.\\n\\nWhen the kdump kernel initializes, PCI busses are scanned and IOMMU\\ngroup/tables created, in pci_dma_bus_setup_pSeriesLP(). For the SR-IOV\\ncase, there is no \\\"ibm,dma-window\\\". The original commit: b1fc44eaa9ba,\\nfixes the path where memory is pre-mapped (direct mapped) to the DDW.\\nWhen TCEs are direct mapped, there is no need to initialize IOMMU\\ntables.\\n\\niommu_table_setparms_lpar() only considers \\\"ibm,dma-window\\\" property\\nwhen initiallizing IOMMU table. In the scenario where TCEs are\\ndynamically allocated for SR-IOV, newly created IOMMU table is not\\ninitialized. Later, when the device driver tries to enter TCEs for the\\nSR-IOV device, NULL pointer execption is thrown from iommu_area_alloc().\\n\\nThe fix is to initialize the IOMMU table with DDW property stored in the\\nFDT. There are 2 points to remember:\\n\\n\\t1. For the dedicated adapter, kdump kernel would encounter both\\n\\t   default and DDW in FDT. In this case, DDW property is used to\\n\\t   initialize the IOMMU table.\\n\\n\\t2. A DDW could be direct or dynamic mapped. kdump kernel would\\n\\t   initialize IOMMU table and mark the existing DDW as\\n\\t   \\\"dynamic\\\". This works fine since, at the time of table\\n\\t   initialization, iommu_table_clear() makes some space in the\\n\\t   DDW, for some predefined number of TCEs which are needed for\\n\\t   kdump to succeed.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.81\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.21\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.9\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.18.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.19.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T08:55:32.393Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26745\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T08:55:32.393Z\", \"dateReserved\": \"2024-02-19T14:20:24.168Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-04T08:20:13.182Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.