CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac
In the Linux kernel, the following vulnerability has been resolved:
Avoid hwdesc array overrun in dw-axi-dmac
I have a use case where nrbuffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descsallocated to be 9. Since axidescput() handles the hwdesc considering the descsallocated, this scenario would result in a kernel panic (hwdesc array will be overrun).
To fix this, the proposal is to add a new member to the axidmadesc structure, where we keep the number of allocated hwdescs (axidescalloc()) and use it in axidescput() to handle the hwdesc array correctly.
Additionally I propose to remove the axichanstartfirstqueued() call after completing the transfer, since it was identified that unbalance can occur (started descriptors can be interrupted and transfer ignored due to DMA channel not being enabled).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40970?
CVE-2024-40970 has been classified with a medium severity due to the potential for array overrun in the DMA channel.
How do I fix CVE-2024-40970?
To mitigate CVE-2024-40970, upgrade the Linux kernel to version 6.1.123-1 or later.
Which versions of the Linux kernel are affected by CVE-2024-40970?
CVE-2024-40970 affects Linux kernel versions prior to 5.15.162, as well as several versions between 5.16 and 6.6.36.
What type of vulnerability is CVE-2024-40970?
CVE-2024-40970 is an array overrun vulnerability that affects the hw_desc array in the Linux kernel.
Is CVE-2024-40970 exploitable on all Linux distributions?
Exploitation of CVE-2024-40970 may vary across distributions but primarily affects those using the vulnerable Linux kernel versions.