mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-30 18:04:30 +00:00
135 lines
8.6 KiB
JSON
135 lines
8.6 KiB
JSON
|
{
|
||
|
|
"data_version": "4.0",
|
||
|
|
"data_type": "CVE",
|
||
|
|
"data_format": "MITRE",
|
||
|
|
"CVE_data_meta": {
|
||
|
|
"ID": "CVE-2024-53058",
|
||
|
|
"ASSIGNER": "cve@kernel.org",
|
||
|
|
"STATE": "PUBLIC"
|
||
|
|
},
|
||
|
|
"description": {
|
||
|
|
"description_data": [
|
||
|
|
{
|
||
|
|
"lang": "eng",
|
||
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data\n\nIn case the non-paged data of a SKB carries protocol header and protocol\npayload to be transmitted on a certain platform that the DMA AXI address\nwidth is configured to 40-bit/48-bit, or the size of the non-paged data\nis bigger than TSO_MAX_BUFF_SIZE on a certain platform that the DMA AXI\naddress width is configured to 32-bit, then this SKB requires at least\ntwo DMA transmit descriptors to serve it.\n\nFor example, three descriptors are allocated to split one DMA buffer\nmapped from one piece of non-paged data:\n dma_desc[N + 0],\n dma_desc[N + 1],\n dma_desc[N + 2].\nThen three elements of tx_q->tx_skbuff_dma[] will be allocated to hold\nextra information to be reused in stmmac_tx_clean():\n tx_q->tx_skbuff_dma[N + 0],\n tx_q->tx_skbuff_dma[N + 1],\n tx_q->tx_skbuff_dma[N + 2].\nNow we focus on tx_q->tx_skbuff_dma[entry].buf, which is the DMA buffer\naddress returned by DMA mapping call. stmmac_tx_clean() will try to\nunmap the DMA buffer _ONLY_IF_ tx_q->tx_skbuff_dma[entry].buf\nis a valid buffer address.\n\nThe expected behavior that saves DMA buffer address of this non-paged\ndata to tx_q->tx_skbuff_dma[entry].buf is:\n tx_q->tx_skbuff_dma[N + 0].buf = NULL;\n tx_q->tx_skbuff_dma[N + 1].buf = NULL;\n tx_q->tx_skbuff_dma[N + 2].buf = dma_map_single();\nUnfortunately, the current code misbehaves like this:\n tx_q->tx_skbuff_dma[N + 0].buf = dma_map_single();\n tx_q->tx_skbuff_dma[N + 1].buf = NULL;\n tx_q->tx_skbuff_dma[N + 2].buf = NULL;\n\nOn the stmmac_tx_clean() side, when dma_desc[N + 0] is closed by the\nDMA engine, tx_q->tx_skbuff_dma[N + 0].buf is a valid buffer address\nobviously, then the DMA buffer will be unmapped immediately.\nThere may be a rare case that the DMA engine does not finish the\npending dma_desc[N + 1], dma_desc[N + 2] yet. Now things will go\nhorribly wrong, DMA is going to access a unmapped/unreferenced memory\nregion, corrupted data will be transmited or iommu fault will be\ntriggered :(\n\nIn contrast, the for-loop that maps SKB fragments behaves perfectly\nas expected, and that is how the driver should do for both non-paged\ndata and paged frags actually.\n\nThis patch corrects DMA map/unmap sequences by fixing the array index\nfor tx_q->tx_skbuff_dma[entry].buf when assigning DMA buffer address.\n\nTested and verified on DWXGMAC CORE 3.20a"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"problemtype": {
|
||
|
|
"problemtype_data": [
|
||
|
|
{
|
||
|
|
"description": [
|
||
|
|
{
|
||
|
|
"lang": "eng",
|
||
|
|
"value": "n/a"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"affects": {
|
||
|
|
"vendor": {
|
||
|
|
"vendor_data": [
|
||
|
|
{
|
||
|
|
"vendor_name": "Linux",
|
||
|
|
"product": {
|
||
|
|
"product_data": [
|
||
|
|
{
|
||
|
|
"product_name": "Linux",
|
||
|
|
"version": {
|
||
|
|
"version_data": [
|
||
|
|
{
|
||
|
|
"version_affected": "<",
|
||
|
|
"version_name": "f748be531d70",
|
||
|
|
"version_value": "ece593fc9c00"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"version_value": "not down converted",
|
||
|
|
"x_cve_json_5_version_data": {
|
||
|
|
"versions": [
|
||
|
|
{
|
||
|
|
"version": "4.7",
|
||
|
|
"status": "affected"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"version": "0",
|
||
|
|
"lessThan": "4.7",
|
||
|
|
"status": "unaffected",
|
||
|
|
"versionType": "semver"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"version": "5.15.171",
|
||
|
|
"lessThanOrEqual": "5.15.*",
|
||
|
|
"status": "unaffected",
|
||
|
|
"versionType": "semver"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"version": "6.1.116",
|
||
|
|
"lessThanOrEqual": "6.1.*",
|
||
|
|
"status": "unaffected",
|
||
|
|
"versionType": "semver"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"version": "6.6.60",
|
||
|
|
"lessThanOrEqual": "6.6.*",
|
||
|
|
"status": "unaffected",
|
||
|
|
"versionType": "semver"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"version": "6.11.7",
|
||
|
|
"lessThanOrEqual": "6.11.*",
|
||
|
|
"status": "unaffected",
|
||
|
|
"versionType": "semver"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"version": "6.12",
|
||
|
|
"lessThanOrEqual": "*",
|
||
|
|
"status": "unaffected",
|
||
|
|
"versionType": "original_commit_for_fix"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"defaultStatus": "affected"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"references": {
|
||
|
|
"reference_data": [
|
||
|
|
{
|
||
|
|
"url": "https://git.kernel.org/stable/c/ece593fc9c00741b682869d3f3dc584d37b7c9df",
|
||
|
|
"refsource": "MISC",
|
||
|
|
"name": "https://git.kernel.org/stable/c/ece593fc9c00741b682869d3f3dc584d37b7c9df"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "https://git.kernel.org/stable/c/a3ff23f7c3f0e13f718900803e090fd3997d6bc9",
|
||
|
|
"refsource": "MISC",
|
||
|
|
"name": "https://git.kernel.org/stable/c/a3ff23f7c3f0e13f718900803e090fd3997d6bc9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "https://git.kernel.org/stable/c/07c9c26e37542486e34d767505e842f48f29c3f6",
|
||
|
|
"refsource": "MISC",
|
||
|
|
"name": "https://git.kernel.org/stable/c/07c9c26e37542486e34d767505e842f48f29c3f6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "https://git.kernel.org/stable/c/58d23d835eb498336716cca55b5714191a309286",
|
||
|
|
"refsource": "MISC",
|
||
|
|
"name": "https://git.kernel.org/stable/c/58d23d835eb498336716cca55b5714191a309286"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "https://git.kernel.org/stable/c/66600fac7a984dea4ae095411f644770b2561ede",
|
||
|
|
"refsource": "MISC",
|
||
|
|
"name": "https://git.kernel.org/stable/c/66600fac7a984dea4ae095411f644770b2561ede"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"generator": {
|
||
|
|
"engine": "bippy-8e903de6a542"
|
||
|
|
}
|
||
|
|
}
|