CVE-2024-32936 (GCVE-0-2024-32936)
Vulnerability from cvelistv5
Published
2024-06-24 13:56
Modified
2026-08-05 11:29
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: media: ti: j721e-csi2rx: Fix races while restarting DMA After the frame is submitted to DMA, it may happen that the submitted list is not updated soon enough, and the DMA callback is triggered before that. This can lead to kernel crashes, so move everything in a single lock/unlock section to prevent such races.
References
Impacted products
Vendor Product Version
Linux Linux Version: b4a3d877dc92963a4db16ddb71df3d333c0d40bd
Version: b4a3d877dc92963a4db16ddb71df3d333c0d40bd
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:27:52.128Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32936",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:08:40.067111Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:43.640Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "80a8b92950f8ee96582dba6187e3c2deca3569ea",
              "status": "affected",
              "version": "b4a3d877dc92963a4db16ddb71df3d333c0d40bd",
              "versionType": "git"
            },
            {
              "lessThan": "ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b",
              "status": "affected",
              "version": "b4a3d877dc92963a4db16ddb71df3d333c0d40bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ti: j721e-csi2rx: Fix races while restarting DMA\n\nAfter the frame is submitted to DMA, it may happen that the submitted\nlist is not updated soon enough, and the DMA callback is triggered\nbefore that.\n\nThis can lead to kernel crashes, so move everything in a single\nlock/unlock section to prevent such races."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered exclusively through `VIDIOC_QBUF` ioctls on the `/dev/videoN` node exported by the j721e-csi2rx capture driver, requiring local system access. No network or physical access is involved.\nAC:L - The attacker creates and controls both sides of the race: buffer starvation is induced at will by withholding QBUF until `dma-\u003estate` becomes `TI_CSI2RX_DMA_IDLE`, and the QBUF that reopens the unlocked window is issued at a chosen instant, repeatable every frame period with unlimited retries; the DMA completion fires promptly because the PSI-L endpoint is already backed up in exactly this stalled state.\nPR:L - Only an unprivileged local account with access to the V4L2 device node is needed \u2014 `v4l2_fh_open` and the vb2 qbuf path perform no capability checks whatsoever. On the affected J721e/AM62 embedded and automotive platforms this is an ordinary camera-capable application user.\nUI:N - The attacking process drives the entire sequence itself via REQBUFS/STREAMON/QBUF; no action by any other user or victim is required.\nS:U - The corruption is confined to kernel heap objects (vb2 buffer structures and the driver\u0027s DMA lists) within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `list_del()` on an unlinked buffer plus double-ownership of vb2 buffers between the driver and userspace yields heap corruption over groomable `kmalloc-2k` objects, which can be leveraged to read adjacent kernel memory; the premature `vb2_buffer_done()` also exposes DMA-target contents to userspace out of sequence.\nI:H - `__list_del()` writes `next-\u003eprev`/`prev-\u003enext` through stale or poisoned pointers on the buffer\u0027s `list_head`, and the doubly-owned buffer allows a second `list_add_tail()` cross-linking `dma-\u003equeue` and `dma-\u003esubmitted` \u2014 a classic list-corruption write primitive suitable for control-flow hijack.\nA:H - The commit explicitly states the race \"can lead to kernel crashes,\" and the sibling fix for the same callback documents `kernel BUG at lib/list_debug.c:65` escalating to \"Kernel panic - not syncing: Fatal exception in interrupt\" because the corruption occurs in softirq context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:49.671Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b"
        }
      ],
      "title": "media: ti: j721e-csi2rx: Fix races while restarting DMA",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-32936",
    "datePublished": "2024-06-24T13:56:48.054Z",
    "dateReserved": "2024-06-24T13:54:11.064Z",
    "dateUpdated": "2026-08-05T11:29:49.671Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T02:27:52.128Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-32936\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:08:40.067111Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:25.407Z\"}}], \"cna\": {\"title\": \"media: ti: j721e-csi2rx: Fix races while restarting DMA\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is entered exclusively through `VIDIOC_QBUF` ioctls on the `/dev/videoN` node exported by the j721e-csi2rx capture driver, requiring local system access. No network or physical access is involved.\\nAC:L - The attacker creates and controls both sides of the race: buffer starvation is induced at will by withholding QBUF until `dma-\u003estate` becomes `TI_CSI2RX_DMA_IDLE`, and the QBUF that reopens the unlocked window is issued at a chosen instant, repeatable every frame period with unlimited retries; the DMA completion fires promptly because the PSI-L endpoint is already backed up in exactly this stalled state.\\nPR:L - Only an unprivileged local account with access to the V4L2 device node is needed \\u2014 `v4l2_fh_open` and the vb2 qbuf path perform no capability checks whatsoever. On the affected J721e/AM62 embedded and automotive platforms this is an ordinary camera-capable application user.\\nUI:N - The attacking process drives the entire sequence itself via REQBUFS/STREAMON/QBUF; no action by any other user or victim is required.\\nS:U - The corruption is confined to kernel heap objects (vb2 buffer structures and the driver\u0027s DMA lists) within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - `list_del()` on an unlinked buffer plus double-ownership of vb2 buffers between the driver and userspace yields heap corruption over groomable `kmalloc-2k` objects, which can be leveraged to read adjacent kernel memory; the premature `vb2_buffer_done()` also exposes DMA-target contents to userspace out of sequence.\\nI:H - `__list_del()` writes `next-\u003eprev`/`prev-\u003enext` through stale or poisoned pointers on the buffer\u0027s `list_head`, and the doubly-owned buffer allows a second `list_add_tail()` cross-linking `dma-\u003equeue` and `dma-\u003esubmitted` \\u2014 a classic list-corruption write primitive suitable for control-flow hijack.\\nA:H - The commit explicitly states the race \\\"can lead to kernel crashes,\\\" and the sibling fix for the same callback documents `kernel BUG at lib/list_debug.c:65` escalating to \\\"Kernel panic - not syncing: Fatal exception in interrupt\\\" because the corruption occurs in softirq context.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b4a3d877dc92963a4db16ddb71df3d333c0d40bd\", \"lessThan\": \"80a8b92950f8ee96582dba6187e3c2deca3569ea\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b4a3d877dc92963a4db16ddb71df3d333c0d40bd\", \"lessThan\": \"ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/80a8b92950f8ee96582dba6187e3c2deca3569ea\"}, {\"url\": \"https://git.kernel.org/stable/c/ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: ti: j721e-csi2rx: Fix races while restarting DMA\\n\\nAfter the frame is submitted to DMA, it may happen that the submitted\\nlist is not updated soon enough, and the DMA callback is triggered\\nbefore that.\\n\\nThis can lead to kernel crashes, so move everything in a single\\nlock/unlock section to prevent such races.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.4\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:29:49.671Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-32936\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:29:49.671Z\", \"dateReserved\": \"2024-06-24T13:54:11.064Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-24T13:56:48.054Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.