CVE-2024-26823 (GCVE-0-2024-26823)
Vulnerability from cvelistv5
Published
2024-04-17 09:43
Modified
2026-08-05 11:27
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems While refactoring the way the ITSs are probed, the handling of quirks applicable to ACPI-based platforms was lost. As a result, systems such as HIP07 lose their GICv4 functionnality, and some other may even fail to boot, unless they are configured to boot with DT. Move the enabling of quirks into its_probe_one(), making it common to all firmware implementations.
References
Impacted products
Vendor Product Version
Linux Linux Version: 9585a495ac936049dba141e8f9d99159ca06d46a
Version: 9585a495ac936049dba141e8f9d99159ca06d46a
Version: 9585a495ac936049dba141e8f9d99159ca06d46a
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.578Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26823",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:49:07.318138Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:32.102Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/irqchip/irq-gic-v3-its.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "91a80fff3eeed928b6fba21271f6a9719b22a5d8",
              "status": "affected",
              "version": "9585a495ac936049dba141e8f9d99159ca06d46a",
              "versionType": "git"
            },
            {
              "lessThan": "4c60c611441f1f1e5de8e00e98ee5a4970778a00",
              "status": "affected",
              "version": "9585a495ac936049dba141e8f9d99159ca06d46a",
              "versionType": "git"
            },
            {
              "lessThan": "8b02da04ad978827e5ccd675acf170198f747a7a",
              "status": "affected",
              "version": "9585a495ac936049dba141e8f9d99159ca06d46a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/irqchip/irq-gic-v3-its.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3-its: Restore quirk probing for ACPI-based systems\n\nWhile refactoring the way the ITSs are probed, the handling of quirks\napplicable to ACPI-based platforms was lost. As a result, systems such as\nHIP07 lose their GICv4 functionnality, and some other may even fail to\nboot, unless they are configured to boot with DT.\n\nMove the enabling of quirks into its_probe_one(), making it common to all\nfirmware implementations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw lives in ARM64 GICv3 ITS irqchip initialization and manifests through local ITS/MSI configuration and device probe; there is no network- or remote-facing input that reaches `its_probe_one()` or `its_create_device()`. Impact requires presence on the affected machine, so the vector is Local.\nAC:L - On any ACPI-booted system the quirk call is unconditionally absent from `gic_acpi_parse_madt_its()`, so every ITS is probed without its errata workarounds every boot \u2014 the defect is fully deterministic, involving no race, no memory-layout dependency, and no condition that must happen to align.\nPR:L - No authentication gate or capability check exists on the path \u2014 the ITS is misprogrammed during boot and the undersized-ITT overrun occurs through ordinary MSI/MSI-X allocation \u2014 but an actor must be locally present on the affected host; there is no unauthenticated remote or anonymous path.\nUI:N - The quirks are skipped automatically during early kernel init on every ACPI boot, and the resulting ITT undersizing and interrupt misdelivery occur during normal device probe with no victim action required.\nS:U - The out-of-bounds ITE writes, the misdirected VMAPP/VMOVP targeting, and the boot failure all occur within the kernel\u0027s own security authority; no IOMMU, hypervisor, or sandbox boundary is bypassed.\nC:H - The ITS writes 16-byte ITEs into a heap buffer sized for 8-byte entries, corrupting adjacent kernel objects; such heap corruption of neighboring pointer/length fields is leverageable for kernel memory disclosure, which the guidance scores as High.\nI:H - Losing the QDF2400 E0065 workaround re-introduces documented kernel memory corruption \u2014 the ITS DMA-writes ITEs past the end of the `kzalloc_node()`-allocated ITT into unrelated kernel heap \u2014 and the missing HIP07 `vlpi_redist_offset` makes the ITS target the wrong redistributor page.\nA:H - The commit states affected systems \"may even fail to boot\" and that HIP07 loses GICv4 entirely; combined with lost/misrouted interrupts on multi-socket ThunderX and heap corruption from the undersized ITT, the result is complete system unavailability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:38.274Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a"
        }
      ],
      "title": "irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26823",
    "datePublished": "2024-04-17T09:43:49.850Z",
    "dateReserved": "2024-02-19T14:20:24.180Z",
    "dateUpdated": "2026-08-05T11:27:38.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.578Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26823\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:49:07.318138Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:17.196Z\"}}], \"cna\": {\"title\": \"irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The flaw lives in ARM64 GICv3 ITS irqchip initialization and manifests through local ITS/MSI configuration and device probe; there is no network- or remote-facing input that reaches `its_probe_one()` or `its_create_device()`. Impact requires presence on the affected machine, so the vector is Local.\\nAC:L - On any ACPI-booted system the quirk call is unconditionally absent from `gic_acpi_parse_madt_its()`, so every ITS is probed without its errata workarounds every boot \\u2014 the defect is fully deterministic, involving no race, no memory-layout dependency, and no condition that must happen to align.\\nPR:L - No authentication gate or capability check exists on the path \\u2014 the ITS is misprogrammed during boot and the undersized-ITT overrun occurs through ordinary MSI/MSI-X allocation \\u2014 but an actor must be locally present on the affected host; there is no unauthenticated remote or anonymous path.\\nUI:N - The quirks are skipped automatically during early kernel init on every ACPI boot, and the resulting ITT undersizing and interrupt misdelivery occur during normal device probe with no victim action required.\\nS:U - The out-of-bounds ITE writes, the misdirected VMAPP/VMOVP targeting, and the boot failure all occur within the kernel\u0027s own security authority; no IOMMU, hypervisor, or sandbox boundary is bypassed.\\nC:H - The ITS writes 16-byte ITEs into a heap buffer sized for 8-byte entries, corrupting adjacent kernel objects; such heap corruption of neighboring pointer/length fields is leverageable for kernel memory disclosure, which the guidance scores as High.\\nI:H - Losing the QDF2400 E0065 workaround re-introduces documented kernel memory corruption \\u2014 the ITS DMA-writes ITEs past the end of the `kzalloc_node()`-allocated ITT into unrelated kernel heap \\u2014 and the missing HIP07 `vlpi_redist_offset` makes the ITS target the wrong redistributor page.\\nA:H - The commit states affected systems \\\"may even fail to boot\\\" and that HIP07 loses GICv4 entirely; combined with lost/misrouted interrupts on multi-socket ThunderX and heap corruption from the undersized ITT, the result is complete system unavailability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9585a495ac936049dba141e8f9d99159ca06d46a\", \"lessThan\": \"91a80fff3eeed928b6fba21271f6a9719b22a5d8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9585a495ac936049dba141e8f9d99159ca06d46a\", \"lessThan\": \"4c60c611441f1f1e5de8e00e98ee5a4970778a00\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9585a495ac936049dba141e8f9d99159ca06d46a\", \"lessThan\": \"8b02da04ad978827e5ccd675acf170198f747a7a\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/irqchip/irq-gic-v3-its.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/irqchip/irq-gic-v3-its.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8\"}, {\"url\": \"https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00\"}, {\"url\": \"https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nirqchip/gic-v3-its: Restore quirk probing for ACPI-based systems\\n\\nWhile refactoring the way the ITSs are probed, the handling of quirks\\napplicable to ACPI-based platforms was lost. As a result, systems such as\\nHIP07 lose their GICv4 functionnality, and some other may even fail to\\nboot, unless they are configured to boot with DT.\\n\\nMove the enabling of quirks into its_probe_one(), making it common to all\\nfirmware implementations.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.18\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.6\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:38.274Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26823\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:38.274Z\", \"dateReserved\": \"2024-02-19T14:20:24.180Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-17T09:43:49.850Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.