Log in Start free

Vulnerability · Published Dec 29, 2024 · Assigned by Linux

CVE-2024-56719net: stmmac: fix TSO DMA API usage causing oops

Critical 10.0

In plain English

A critical-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.5%top 54.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing oops Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s members to be later in stmmac_tso_xmit(). The buf (dma cookie) and len stored in this structure are passed to dma_unmap_single() by stmmac_tx_clean(). The DMA API requires that the dma cookie passed to dma_unmap_single() is the same as the value returned from dma_map_single(). However, by moving the assignment later, this is not the case when priv->dma_cap.addr64 > 32 as "des" is offset by proto_hdr_len. This causes problems such as: dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed and with DMA_API_DEBUG enabled: DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes] Fix this by maintaining "des" as the original DMA cookie, and use tso_des to pass the offset DMA cookie to stmmac_tso_allocator(). Full details of the crashes can be found at: https://lore.kernel.org/all/d8112193-0386-4e14-b516-37c2d838171a@nvidia.com/ https://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5turc@bwwhelz2l4dw/

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.170-1DEBIAN-CVE-2024-56719
Debian:13linux6.12.8-1DEBIAN-CVE-2024-56719
Debian:14linux6.12.8-1DEBIAN-CVE-2024-56719
Ubuntu:22.04:LTSlinux5.15.0-186.196UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux5.15.0-186.196USN-8575-1
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-aws5.15.0-1112.119UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-aws5.15.0-1112.119USN-8575-2
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-azure5.15.0-1117.126USN-8575-3
Ubuntu:22.04:LTSlinux-azure5.15.0-1117.126UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1117.126UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1117.126USN-8610-1
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-gcp5.15.0-1112.122UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-gcp5.15.0-1112.122USN-8575-1
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-gke5.15.0-1108.114USN-8575-1
Ubuntu:22.04:LTSlinux-gke5.15.0-1108.114UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1095.103USN-8575-1
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1095.103UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-56719
Ubuntu:24.04:LTSlinux-hwe-6.116.11.0-21.21~24.04.1UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-ibm5.15.0-1106.110UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-ibm5.15.0-1106.110USN-8575-2
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1107.113UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1107.113USN-8620-4
Ubuntu:22.04:LTSlinux-kvm5.15.0-1104.109USN-8575-1
Ubuntu:22.04:LTSlinux-kvm5.15.0-1104.109UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-184.194USN-8575-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-184.194UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1107.108USN-8575-2
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1107.108UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1064.66UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1064.66USN-8576-2
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1053.53USN-8576-2
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1053.53UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-56719
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1017.17UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-oracle5.15.0-1109.115USN-8575-3
Ubuntu:22.04:LTSlinux-oracle5.15.0-1109.115UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-raspi5.15.0-1106.109UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-raspi5.15.0-1106.109USN-8668-2
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1075.79UBUNTU-CVE-2024-56719
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1075.79USN-8575-1

Affected products (as reported)

VendorProductVersions
Linux Linux ece593fc9c00741b682869d3f3dc584d37b7c9df – before 05968b6dd0ffc65d7386608b11a11fb4fdfc9f36a3ff23f7c3f0e13f718900803e090fd3997d6bc9 – before 6abcdc9a73274052a9e96a1926994ecf9aedad8207c9c26e37542486e34d767505e842f48f29c3f6 – before db3667c9bbfbbf5de98e6c9542f7e03fb524328666600fac7a984dea4ae095411f644770b2561ede – before 9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e266600fac7a984dea4ae095411f644770b2561ede – before 4c49f38e20a57f8abaebdf95b369295b153d1f8e58d23d835eb498336716cca55b5714191a3092865.15.171 – before 5.15.2096.1.116 – before 6.1.167
Linux Linux 6.12

References