Vulnerability Details CVE-2024-56719
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix TSO DMA API usage causing oops
Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap
for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s
members to be later in stmmac_tso_xmit().
The buf (dma cookie) and len stored in this structure are passed to
dma_unmap_single() by stmmac_tx_clean(). The DMA API requires that
the dma cookie passed to dma_unmap_single() is the same as the value
returned from dma_map_single(). However, by moving the assignment
later, this is not the case when priv->dma_cap.addr64 > 32 as "des"
is offset by proto_hdr_len.
This causes problems such as:
dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed
and with DMA_API_DEBUG enabled:
DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes]
Fix this by maintaining "des" as the original DMA cookie, and use
tso_des to pass the offset DMA cookie to stmmac_tso_allocator().
Full details of the crashes can be found at:
https://lore.kernel.org/all/d8112193-0386-4e14-b516-37c2d838171a@nvidia.com/
https://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5turc@bwwhelz2l4dw/
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 6.6%
CVSS Severity
CVSS v3 Score 5.5
Products affected by CVE-2024-56719
-
cpe:2.3:o:linux:linux_kernel:5.15.171
-
cpe:2.3:o:linux:linux_kernel:5.15.172
-
cpe:2.3:o:linux:linux_kernel:5.15.173
-
cpe:2.3:o:linux:linux_kernel:5.15.174
-
cpe:2.3:o:linux:linux_kernel:5.15.175
-
cpe:2.3:o:linux:linux_kernel:5.15.176
-
cpe:2.3:o:linux:linux_kernel:5.15.177
-
cpe:2.3:o:linux:linux_kernel:5.15.178
-
cpe:2.3:o:linux:linux_kernel:5.15.179
-
cpe:2.3:o:linux:linux_kernel:5.15.180
-
cpe:2.3:o:linux:linux_kernel:6.1.116
-
cpe:2.3:o:linux:linux_kernel:6.1.117
-
cpe:2.3:o:linux:linux_kernel:6.1.118
-
cpe:2.3:o:linux:linux_kernel:6.1.119
-
cpe:2.3:o:linux:linux_kernel:6.1.120
-
cpe:2.3:o:linux:linux_kernel:6.1.121
-
cpe:2.3:o:linux:linux_kernel:6.1.122
-
cpe:2.3:o:linux:linux_kernel:6.1.123
-
cpe:2.3:o:linux:linux_kernel:6.1.124
-
cpe:2.3:o:linux:linux_kernel:6.1.125
-
cpe:2.3:o:linux:linux_kernel:6.1.126
-
cpe:2.3:o:linux:linux_kernel:6.1.127
-
cpe:2.3:o:linux:linux_kernel:6.1.128
-
cpe:2.3:o:linux:linux_kernel:6.1.129
-
cpe:2.3:o:linux:linux_kernel:6.1.130
-
cpe:2.3:o:linux:linux_kernel:6.1.131
-
cpe:2.3:o:linux:linux_kernel:6.1.132
-
cpe:2.3:o:linux:linux_kernel:6.1.133
-
cpe:2.3:o:linux:linux_kernel:6.1.134
-
cpe:2.3:o:linux:linux_kernel:6.1.135
-
cpe:2.3:o:linux:linux_kernel:6.11.10
-
cpe:2.3:o:linux:linux_kernel:6.11.11
-
cpe:2.3:o:linux:linux_kernel:6.11.7
-
cpe:2.3:o:linux:linux_kernel:6.11.8
-
cpe:2.3:o:linux:linux_kernel:6.11.9
-
cpe:2.3:o:linux:linux_kernel:6.12
-
cpe:2.3:o:linux:linux_kernel:6.12.1
-
cpe:2.3:o:linux:linux_kernel:6.12.2
-
cpe:2.3:o:linux:linux_kernel:6.12.3
-
cpe:2.3:o:linux:linux_kernel:6.12.4
-
cpe:2.3:o:linux:linux_kernel:6.12.5
-
cpe:2.3:o:linux:linux_kernel:6.12.6
-
cpe:2.3:o:linux:linux_kernel:6.13
-
cpe:2.3:o:linux:linux_kernel:6.6.60
-
cpe:2.3:o:linux:linux_kernel:6.6.61
-
cpe:2.3:o:linux:linux_kernel:6.6.62
-
cpe:2.3:o:linux:linux_kernel:6.6.63
-
cpe:2.3:o:linux:linux_kernel:6.6.64
-
cpe:2.3:o:linux:linux_kernel:6.6.65
-
cpe:2.3:o:linux:linux_kernel:6.6.66
-
cpe:2.3:o:linux:linux_kernel:6.6.67