CVE-2024-44976

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-44976
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-44976.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-44976
Related
Published
2024-09-04T20:15:07Z
Modified
2024-10-10T18:45:20.442544Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

ata: pata_macio: Fix DMA table overflow

Kolbjørn and Jonáš reported that their 32-bit PowerMacs were crashing in pata-macio since commit 09fe2bfa6b83 ("ata: patamacio: Fix maxsegmentsize with PAGESIZE == 64K").

For example:

kernel BUG at drivers/ata/patamacio.c:544! Oops: Exception in kernel mode, sig: 5 [#1] BE PAGESIZE=4K MMU=Hash SMP NRCPUS=2 DEBUGPAGEALLOC PowerMac ... NIP patamacioqcprep+0xf4/0x190 LR patamacioqcprep+0xfc/0x190 Call Trace: 0xc1421660 (unreliable) ataqcissue+0x14c/0x2d4 _atascsiqueuecmd+0x200/0x53c atascsiqueuecmd+0x50/0xe0 scsiqueuerq+0x788/0xb1c _blkmqissuedirectly+0x58/0xf4 blkmqplugissuedirect+0x8c/0x1b4 blkmqflushpluglist.part.0+0x584/0x5e0 _blkflushplug+0xf8/0x194 _submitbio+0x1b8/0x2e0 submitbionoacctnocheck+0x230/0x304 btrfsworkhelper+0x200/0x338 processonework+0x1a8/0x338 workerthread+0x364/0x4c0 kthread+0x100/0x104 startkernelthread+0x10/0x14

That commit increased maxsegmentsize to 64KB, with the justification that the SCSI core was already using that size when PAGE_SIZE == 64KB, and that there was existing logic to split over-sized requests.

However with a sufficiently large request, the splitting logic causes each sg to be split into two commands in the DMA table, leading to overflow of the DMA table, triggering the BUG_ON().

With default settings the bug doesn't trigger, because the request size is limited by maxsectorskb == 1280, however maxsectorskb can be increased, and apparently some distros do that by default using udev rules.

Fix the bug for 4KB kernels by reverting to the old maxsegmentsize.

For 64KB kernels the sg_tablesize needs to be halved, to allow for the possibility that each sg will be split into two.

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.10.7-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1
6.7.12-1
6.8.9-1
6.8.11-1
6.8.12-1~bpo12+1
6.8.12-1
6.9.2-1~exp1
6.9.7-1~bpo12+1
6.9.7-1
6.9.8-1
6.9.9-1
6.9.10-1~bpo12+1
6.9.10-1
6.9.11-1
6.9.12-1
6.10-1~exp1
6.10.1-1~exp1
6.10.3-1
6.10.4-1
6.10.6-1~bpo12+1
6.10.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}