CVE-2024-44994 (GCVE-0-2024-44994)
Vulnerability from cvelistv5
Published
2024-09-04 19:54
Modified
2026-08-05 11:37
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu: Restore lost return in iommu_report_device_fault() When iommu_report_device_fault gets called with a partial fault it is supposed to collect the fault into the group and then return. Instead the return was accidently deleted which results in trying to process the fault and an eventual crash. Deleting the return was a typo, put it back.
Impacted products
Vendor Product Version
Linux Linux Version: 3dfa64aecbafc288216b2790438d395add192c30
Version: 3dfa64aecbafc288216b2790438d395add192c30
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44994",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T20:19:24.535460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T20:19:36.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/io-pgfault.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc6bc2ab1663ec9353636416af22452b078510e9",
              "status": "affected",
              "version": "3dfa64aecbafc288216b2790438d395add192c30",
              "versionType": "git"
            },
            {
              "lessThan": "fca5b78511e98bdff2cdd55c172b23200a7b3404",
              "status": "affected",
              "version": "3dfa64aecbafc288216b2790438d395add192c30",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/io-pgfault.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Restore lost return in iommu_report_device_fault()\n\nWhen iommu_report_device_fault gets called with a partial fault it is\nsupposed to collect the fault into the group and then return.\n\nInstead the return was accidently deleted which results in trying to\nprocess the fault and an eventual crash.\n\nDeleting the return was a typo, put it back."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through IOMMU PRI/PPR page requests generated by a device under local control \u2014 an unprivileged process driving an SVA-capable accelerator (`/dev/dsa/wq*`, `/dev/kfd`) or a guest VM with an assigned PRI device whose PASID table it owns. No network or physical access is required.\nAC:L - The very first page request with the LPIG/last-page bit clear deterministically falls through into the group path; there is no race, timing window, or memory-layout precondition for the double free. The attacker controls the device\u0027s page-request stream, and multi-request PRG groups are ordinary PRI behaviour.\nPR:L - Only access to an SVA/PASID-capable device node is needed \u2014 idxd and amdkfd char devices are intentionally exposed to unprivileged userspace for shared-virtual-addressing workloads \u2014 or ordinary guest privileges on a VM with an assigned device. No root or CAP_SYS_ADMIN is required.\nUI:N - The fault is generated by the attacker\u0027s own DMA/descriptor submission and handled in the IOMMU fault worker; no action by any other user or administrator is involved.\nS:C - The corruption is driven entirely by device-originated PRI input, so a guest-assigned or malicious PRI-capable peripheral escapes the IOMMU\u0027s device-isolation authority into host kernel memory; the code additionally acks an incomplete PRG back to the device, manipulating the DMA-isolation control plane itself.\nC:H - The double-freed `iopf_group` and the prematurely freed `iommu_fault_param` \u2014 still reachable via `dev-\u003eiommu-\u003efault_param` and `queue-\u003edevices` \u2014 give an attacker who reclaims the slab full read access to kernel heap contents, including the `dev`/`ops` pointers dereferenced on the next fault.\nI:H - A double free in a general-purpose kmalloc cache plus `list_add()` writes into a reallocated `iommu_fault_param` yield arbitrary-write and cross-cache primitives, and `ops-\u003epage_response()` is called through pointers read from the freed object, enabling control-flow hijack and privilege escalation.\nA:H - The commit itself states the fall-through results in \"an eventual crash\"; the double free, refcount underflow (refcount_t saturation warning), and subsequent use-after-free reliably oops or panic the kernel, and on `abort_group` it calls `kfree()` on a kernel stack address."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:33.085Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc6bc2ab1663ec9353636416af22452b078510e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fca5b78511e98bdff2cdd55c172b23200a7b3404"
        }
      ],
      "title": "iommu: Restore lost return in iommu_report_device_fault()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44994",
    "datePublished": "2024-09-04T19:54:40.214Z",
    "dateReserved": "2024-08-21T05:34:56.672Z",
    "dateUpdated": "2026-08-05T11:37:33.085Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-44994\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-04T20:19:24.535460Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-04T20:19:26.964Z\"}}], \"cna\": {\"title\": \"iommu: Restore lost return in iommu_report_device_fault()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached through IOMMU PRI/PPR page requests generated by a device under local control \\u2014 an unprivileged process driving an SVA-capable accelerator (`/dev/dsa/wq*`, `/dev/kfd`) or a guest VM with an assigned PRI device whose PASID table it owns. No network or physical access is required.\\nAC:L - The very first page request with the LPIG/last-page bit clear deterministically falls through into the group path; there is no race, timing window, or memory-layout precondition for the double free. The attacker controls the device\u0027s page-request stream, and multi-request PRG groups are ordinary PRI behaviour.\\nPR:L - Only access to an SVA/PASID-capable device node is needed \\u2014 idxd and amdkfd char devices are intentionally exposed to unprivileged userspace for shared-virtual-addressing workloads \\u2014 or ordinary guest privileges on a VM with an assigned device. No root or CAP_SYS_ADMIN is required.\\nUI:N - The fault is generated by the attacker\u0027s own DMA/descriptor submission and handled in the IOMMU fault worker; no action by any other user or administrator is involved.\\nS:C - The corruption is driven entirely by device-originated PRI input, so a guest-assigned or malicious PRI-capable peripheral escapes the IOMMU\u0027s device-isolation authority into host kernel memory; the code additionally acks an incomplete PRG back to the device, manipulating the DMA-isolation control plane itself.\\nC:H - The double-freed `iopf_group` and the prematurely freed `iommu_fault_param` \\u2014 still reachable via `dev-\u003eiommu-\u003efault_param` and `queue-\u003edevices` \\u2014 give an attacker who reclaims the slab full read access to kernel heap contents, including the `dev`/`ops` pointers dereferenced on the next fault.\\nI:H - A double free in a general-purpose kmalloc cache plus `list_add()` writes into a reallocated `iommu_fault_param` yield arbitrary-write and cross-cache primitives, and `ops-\u003epage_response()` is called through pointers read from the freed object, enabling control-flow hijack and privilege escalation.\\nA:H - The commit itself states the fall-through results in \\\"an eventual crash\\\"; the double free, refcount underflow (refcount_t saturation warning), and subsequent use-after-free reliably oops or panic the kernel, and on `abort_group` it calls `kfree()` on a kernel stack address.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3dfa64aecbafc288216b2790438d395add192c30\", \"lessThan\": \"cc6bc2ab1663ec9353636416af22452b078510e9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3dfa64aecbafc288216b2790438d395add192c30\", \"lessThan\": \"fca5b78511e98bdff2cdd55c172b23200a7b3404\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/iommu/io-pgfault.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/iommu/io-pgfault.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cc6bc2ab1663ec9353636416af22452b078510e9\"}, {\"url\": \"https://git.kernel.org/stable/c/fca5b78511e98bdff2cdd55c172b23200a7b3404\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu: Restore lost return in iommu_report_device_fault()\\n\\nWhen iommu_report_device_fault gets called with a partial fault it is\\nsupposed to collect the fault into the group and then return.\\n\\nInstead the return was accidently deleted which results in trying to\\nprocess the fault and an eventual crash.\\n\\nDeleting the return was a typo, put it back.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.7\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:37:33.085Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-44994\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:37:33.085Z\", \"dateReserved\": \"2024-08-21T05:34:56.672Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-04T19:54:40.214Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…