Log in Start free

Vulnerability · Published Apr 17, 2024 · Assigned by Linux

CVE-2024-26847powerpc/rtas: use correct function name for resetting TCE tables

Medium 5.1

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.1Medium
Exploit odds (30 days)0.2%top 84.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: use correct function name for resetting TCE tables The PAPR spec spells the function name as "ibm,reset-pe-dma-windows" but in practice firmware uses the singular form: "ibm,reset-pe-dma-window" in the device tree. Since we have the wrong spelling in the RTAS function table, reverse lookups (token -> name) fail and warn: unexpected failed lookup for token 86 WARNING: CPU: 1 PID: 545 at arch/powerpc/kernel/rtas.c:659 __do_enter_rtas_trace+0x2a4/0x2b4 CPU: 1 PID: 545 Comm: systemd-udevd Not tainted 6.8.0-rc4 #30 Hardware name: IBM,9105-22A POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NL1060_028) hv:phyp pSeries NIP [c0000000000417f0] __do_enter_rtas_trace+0x2a4/0x2b4 LR [c0000000000417ec] __do_enter_rtas_trace+0x2a0/0x2b4 Call Trace: __do_enter_rtas_trace+0x2a0/0x2b4 (unreliable) rtas_call+0x1f8/0x3e0 enable_ddw.constprop.0+0x4d0/0xc84 dma_iommu_dma_supported+0xe8/0x24c dma_set_mask+0x5c/0xd8 mlx5_pci_init.constprop.0+0xf0/0x46c [mlx5_core] probe_one+0xfc/0x32c [mlx5_core] local_pci_probe+0x68/0x12c pci_call_probe+0x68/0x1ec pci_device_probe+0xbc/0x1a8 really_probe+0x104/0x570 __driver_probe_device+0xb8/0x224 driver_probe_device+0x54/0x130 __driver_attach+0x158/0x2b0 bus_for_each_dev+0xa8/0x120 driver_attach+0x34/0x48 bus_add_driver+0x174/0x304 driver_register+0x8c/0x1c4 __pci_register_driver+0x68/0x7c mlx5_init+0xb8/0x118 [mlx5_core] do_one_initcall+0x60/0x388 do_init_module+0x7c/0x2a4 init_module_from_file+0xb4/0x108 idempotent_init_module+0x184/0x34c sys_finit_module+0x90/0x114 And oopses are possible when lockdep is enabled or the RTAS tracepoints are active, since those paths dereference the result of the lookup. Use the correct spelling to match firmware's behavior, adjusting the related constants to match.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.7.9-1DEBIAN-CVE-2024-26847
Debian:14linux6.7.9-1DEBIAN-CVE-2024-26847
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-26847
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-26847

Affected products (as reported)

VendorProductVersions
Linux Linux 8252b88294d2a744df6e3c6d85909ade403a5f2c – before 6b6282d56b14879124416a23837af9bd52ae2dfb8252b88294d2a744df6e3c6d85909ade403a5f2c – before dd63817baf334888289877ab1db1d866af2a64798252b88294d2a744df6e3c6d85909ade403a5f2c – before fad87dbd48156ab940538f052f1820f4b6ed2819
Linux Linux 6.3

References