Log in Start free

Vulnerability · Published Apr 4, 2024 · Assigned by Linux

CVE-2024-26786iommufd: Fix iopt_access_list_id overwrite bug

High 7.8

In plain English

A high-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 85.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix iopt_access_list_id overwrite bug Syzkaller reported the following WARN_ON: WARNING: CPU: 1 PID: 4738 at drivers/iommu/iommufd/io_pagetable.c:1360 Call Trace: iommufd_access_change_ioas+0x2fe/0x4e0 iommufd_access_destroy_object+0x50/0xb0 iommufd_object_remove+0x2a3/0x490 iommufd_object_destroy_user iommufd_access_destroy+0x71/0xb0 iommufd_test_staccess_release+0x89/0xd0 __fput+0x272/0xb50 __fput_sync+0x4b/0x60 __do_sys_close __se_sys_close __x64_sys_close+0x8b/0x110 do_syscall_x64 The mismatch between the access pointer in the list and the passed-in pointer is resulting from an overwrite of access->iopt_access_list_id, in iopt_add_access(). Called from iommufd_access_change_ioas() when xa_alloc() succeeds but iopt_calculate_iova_alignment() fails. Add a new_id in iopt_add_access() and only update iopt_access_list_id when returning successfully.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.7.9-1DEBIAN-CVE-2024-26786
Debian:14linux6.7.9-1DEBIAN-CVE-2024-26786
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-26786
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-26786

Affected products (as reported)

VendorProductVersions
Linux Linux 9227da7816dd1a42e20d41e2244cb63c205477ca – before f1fb745ee0a6fe43f1d84ec369c7e6af2310fda99227da7816dd1a42e20d41e2244cb63c205477ca – before 9526a46cc0c378d381560279bea9aa34c84298a09227da7816dd1a42e20d41e2244cb63c205477ca – before aeb004c0cd6958e910123a1607634401009c9539
Linux Linux 6.6

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References