CVE-2024-36884

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-36884
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36884.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-36884
Related
Published
2024-05-30T16:15:11Z
Modified
2024-09-18T03:26:23.638467Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu: Use the correct type in nvidiasmmucontext_fault()

This was missed because of the function pointer indirection.

nvidiasmmucontextfault() is also installed as a irq function, and the 'void *' was changed to a struct armsmmudomain. Since the iommudomain is embedded at a non-zero offset this causes nvidiasmmucontext_fault() to miscompute the offset. Fixup the types.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000120 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107c9f000 [0000000000000120] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 1 PID: 47 Comm: kworker/u25:0 Not tainted 6.9.0-0.rc7.58.eln136.aarch64 #1 Hardware name: Unknown NVIDIA Jetson Orin NX/NVIDIA Jetson Orin NX, BIOS 3.1-32827747 03/19/2023 Workqueue: eventsunbound deferredprobeworkfunc pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : nvidiasmmucontextfault+0x1c/0x158 lr : _freeirq+0x1d4/0x2e8 sp : ffff80008044b6f0 x29: ffff80008044b6f0 x28: ffff000080a60b18 x27: ffffd32b5172e970 x26: 0000000000000000 x25: ffff0000802f5aac x24: ffff0000802f5a30 x23: ffff0000802f5b60 x22: 0000000000000057 x21: 0000000000000000 x20: ffff0000802f5a00 x19: ffff000087d4cd80 x18: ffffffffffffffff x17: 6234362066666666 x16: 6630303078302d30 x15: ffff00008156d888 x14: 0000000000000000 x13: ffff0000801db910 x12: ffff00008156d6d0 x11: 0000000000000003 x10: ffff0000801db918 x9 : ffffd32b50f94d9c x8 : 1fffe0001032fda1 x7 : ffff00008197ed00 x6 : 000000000000000f x5 : 000000000000010e x4 : 000000000000010e x3 : 0000000000000000 x2 : ffffd32b51720cd8 x1 : ffff000087e6f700 x0 : 0000000000000057 Call trace: nvidiasmmucontextfault+0x1c/0x158 _freeirq+0x1d4/0x2e8 freeirq+0x3c/0x80 devmfreeirq+0x64/0xa8 armsmmudomainfree+0xc4/0x158 iommudomainfree+0x44/0xa0 iommudeinitdevice+0xd0/0xf8 _iommugroupremovedevice+0xcc/0xe0 iommubusnotifier+0x64/0xa8 notifiercallchain+0x78/0x148 blockingnotifiercallchain+0x4c/0x90 busnotify+0x44/0x70 devicedel+0x264/0x3e8 pciremovebusdevice+0x84/0x120 pciremoverootbus+0x5c/0xc0 dwpciehostdeinit+0x38/0xe0 tegrapcieconfigrp+0xc0/0x1f0 tegrapciedwprobe+0x34c/0x700 platformprobe+0x70/0xe8 reallyprobe+0xc8/0x3a0 _driverprobedevice+0x84/0x160 driverprobedevice+0x44/0x130 _deviceattachdriver+0xc4/0x170 busforeachdrv+0x90/0x100 _deviceattach+0xa8/0x1c8 deviceinitialprobe+0x1c/0x30 busprobedevice+0xb0/0xc0 deferredprobeworkfunc+0xbc/0x120 processonework+0x194/0x490 workerthread+0x284/0x3b0 kthread+0xf4/0x108 retfrom_fork+0x10/0x20 Code: a9b97bfd 910003fd a9025bf5 f85a0035 (b94122a1)

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.8.11-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1
6.7.12-1
6.8.9-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}