CVE-2024-26847

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26847
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26847.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26847
Related
Published
2024-04-17T11:15:08Z
Modified
2024-11-01T16:49:14.607155Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

powerpc/rtas: use correct function name for resetting TCE tables

The PAPR spec spells the function name as

"ibm,reset-pe-dma-windows"

but in practice firmware uses the singular form:

"ibm,reset-pe-dma-window"

in the device tree. Since we have the wrong spelling in the RTAS function table, reverse lookups (token -> name) fail and warn:

unexpected failed lookup for token 86 WARNING: CPU: 1 PID: 545 at arch/powerpc/kernel/rtas.c:659 _doenterrtastrace+0x2a4/0x2b4 CPU: 1 PID: 545 Comm: systemd-udevd Not tainted 6.8.0-rc4 #30 Hardware name: IBM,9105-22A POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NL1060028) hv:phyp pSeries NIP [c0000000000417f0] _doenterrtastrace+0x2a4/0x2b4 LR [c0000000000417ec] _doenterrtastrace+0x2a0/0x2b4 Call Trace: _doenterrtastrace+0x2a0/0x2b4 (unreliable) rtascall+0x1f8/0x3e0 enableddw.constprop.0+0x4d0/0xc84 dmaiommudmasupported+0xe8/0x24c dmasetmask+0x5c/0xd8 mlx5pciinit.constprop.0+0xf0/0x46c [mlx5core] probeone+0xfc/0x32c [mlx5core] localpciprobe+0x68/0x12c pcicallprobe+0x68/0x1ec pcideviceprobe+0xbc/0x1a8 reallyprobe+0x104/0x570 _driverprobedevice+0xb8/0x224 driverprobedevice+0x54/0x130 _driverattach+0x158/0x2b0 busforeachdev+0xa8/0x120 driverattach+0x34/0x48 busadddriver+0x174/0x304 driverregister+0x8c/0x1c4 _pciregisterdriver+0x68/0x7c mlx5init+0xb8/0x118 [mlx5core] dooneinitcall+0x60/0x388 doinitmodule+0x7c/0x2a4 initmodulefromfile+0xb4/0x108 idempotentinitmodule+0x184/0x34c sysfinitmodule+0x90/0x114

And oopses are possible when lockdep is enabled or the RTAS tracepoints are active, since those paths dereference the result of the lookup.

Use the correct spelling to match firmware's behavior, adjusting the related constants to match.

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.7.9-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}