CVE-2024-35843

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-35843", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.104Z", "datePublished": "2024-05-17T14:40:10.747Z", "dateUpdated": "2026-08-05T11:30:15.505Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:15.505Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Use device rbtree in iopf reporting path\n\nThe existing I/O page fault handler currently locates the PCI device by\ncalling pci_get_domain_bus_and_slot(). This function searches the list\nof all PCI devices until the desired device is found. To improve lookup\nefficiency, replace it with device_rbtree_find() to search the device\nwithin the probed device rbtree.\n\nThe I/O page fault is initiated by the device, which does not have any\nsynchronization mechanism with the software to ensure that the device\nstays in the probed device tree. Theoretically, a device could be released\nby the IOMMU subsystem after device_rbtree_find() and before\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\n\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\nrelease device path. This lock doesn't introduce any performance overhead,\nas the conflict between I/O page fault reporting and device releasing is\nvery rare."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable `prq_event_thread()` is driven by device-generated PCIe Page Requests, which local software can produce on demand through an SVA-capable accelerator work queue, a DRM render node, or a PRI-capable device assigned to a guest via VFIO/IOMMUFD. There is no network or physical-only requirement.\nAC:L - The attacker can flood the PRQ ring (even provoking PRQ overflow) to keep the racy window continuously executing and retry indefinitely, and in the assigned-device/malicious-endpoint case also controls the removal side via link-down, surprise-removal or AER-triggered teardown. The window is also structurally wide because `device_del()` frees `dev->iommu` before `pci_destroy_dev()` unlinks the device from the PCI bus list, so `pci_get_domain_bus_and_slot()` keeps returning a device whose `dev->iommu` is already freed.\nPR:L - Only access to a device that can emit page requests is needed \u2014 an SVA work queue or render node routinely granted to unprivileged users, or guest-side control of a passed-through device. No real root or CAP_SYS_ADMIN in the init namespace is required.\nUI:N - The page request is generated by the attacker-driven device and handled asynchronously in the IOMMU threaded IRQ handler; no victim action is involved.\nS:C - The VT-d driver is the authority that confines DMA-capable devices to their assigned address spaces, and here a device-initiated page request corrupts host kernel memory outside that confinement. In the passthrough deployment this is a guest/device-to-host escape across the IOMMU isolation boundary.\nC:H - The use-after-free reads `param->fault_param` and `fparam->data` out of a freed kmalloc-96/128 object that an unprivileged process can reallocate with sprayed content, turning the subsequent dereferences into an arbitrary kernel-memory read and disclosure primitive.\nI:H - `mutex_lock(&param->lock)` writes into the freed object, `list_add_tail(&evt_pending->list, &fparam->faults)` gives a write through an attacker-controlled pointer, and `fparam->handler(&evt->fault, fparam->data)` is an indirect call through a function pointer read from freed memory \u2014 a control-flow hijack primitive.\nA:H - Dereferencing the freed `dev_iommu` in the IOMMU threaded IRQ handler oopses or panics the kernel, and a corrupted mutex in that path can hang all subsequent page-fault handling."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/intel/dmar.c", "drivers/iommu/intel/iommu.c", "drivers/iommu/intel/iommu.h", "drivers/iommu/intel/svm.c"], "versions": [{"version": "06f4b8d09dbabec631ed7b033f5d5413d86c7134", "lessThan": "3d39238991e745c5df85785604f037f35d9d1b15", "status": "affected", "versionType": "git"}, {"version": "06f4b8d09dbabec631ed7b033f5d5413d86c7134", "lessThan": "def054b01a867822254e1dda13d587f5c7a99e2a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/intel/dmar.c", "drivers/iommu/intel/iommu.c", "drivers/iommu/intel/iommu.h", "drivers/iommu/intel/svm.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.2", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.8.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15"}, {"url": "https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"}], "title": "iommu/vt-d: Use device rbtree in iopf reporting path", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1da177e4c3f4", "status": "affected", "lessThan": "3d39238991e7", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1da177e4c3f4", "status": "affected", "lessThan": "def054b01a86", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.8.2", "status": "unaffected", "lessThanOrEqual": "6.8.*", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.9", "status": "unaffected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-04T19:36:46.083168Z", "id": "CVE-2024-35843", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "ADP Container", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T19:36:51.450Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:49.021Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:49.021Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-35843", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-04T19:36:46.083168Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "3d39238991e7", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "def054b01a86", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.8.2", "versionType": "custom", "lessThanOrEqual": "6.8.*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.9"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-17T17:52:10.902Z"}}], "cna": {"title": "iommu/vt-d: Use device rbtree in iopf reporting path", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable `prq_event_thread()` is driven by device-generated PCIe Page Requests, which local software can produce on demand through an SVA-capable accelerator work queue, a DRM render node, or a PRI-capable device assigned to a guest via VFIO/IOMMUFD. There is no network or physical-only requirement.\nAC:L - The attacker can flood the PRQ ring (even provoking PRQ overflow) to keep the racy window continuously executing and retry indefinitely, and in the assigned-device/malicious-endpoint case also controls the removal side via link-down, surprise-removal or AER-triggered teardown. The window is also structurally wide because `device_del()` frees `dev->iommu` before `pci_destroy_dev()` unlinks the device from the PCI bus list, so `pci_get_domain_bus_and_slot()` keeps returning a device whose `dev->iommu` is already freed.\nPR:L - Only access to a device that can emit page requests is needed \u2014 an SVA work queue or render node routinely granted to unprivileged users, or guest-side control of a passed-through device. No real root or CAP_SYS_ADMIN in the init namespace is required.\nUI:N - The page request is generated by the attacker-driven device and handled asynchronously in the IOMMU threaded IRQ handler; no victim action is involved.\nS:C - The VT-d driver is the authority that confines DMA-capable devices to their assigned address spaces, and here a device-initiated page request corrupts host kernel memory outside that confinement. In the passthrough deployment this is a guest/device-to-host escape across the IOMMU isolation boundary.\nC:H - The use-after-free reads `param->fault_param` and `fparam->data` out of a freed kmalloc-96/128 object that an unprivileged process can reallocate with sprayed content, turning the subsequent dereferences into an arbitrary kernel-memory read and disclosure primitive.\nI:H - `mutex_lock(&param->lock)` writes into the freed object, `list_add_tail(&evt_pending->list, &fparam->faults)` gives a write through an attacker-controlled pointer, and `fparam->handler(&evt->fault, fparam->data)` is an indirect call through a function pointer read from freed memory \u2014 a control-flow hijack primitive.\nA:H - Dereferencing the freed `dev_iommu` in the IOMMU threaded IRQ handler oopses or panics the kernel, and a corrupted mutex in that path can hang all subsequent page-fault handling."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "06f4b8d09dbabec631ed7b033f5d5413d86c7134", "lessThan": "3d39238991e745c5df85785604f037f35d9d1b15", "versionType": "git"}, {"status": "affected", "version": "06f4b8d09dbabec631ed7b033f5d5413d86c7134", "lessThan": "def054b01a867822254e1dda13d587f5c7a99e2a", "versionType": "git"}], "programFiles": ["drivers/iommu/intel/dmar.c", "drivers/iommu/intel/iommu.c", "drivers/iommu/intel/iommu.h", "drivers/iommu/intel/svm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"status": "unaffected", "version": "0", "lessThan": "6.1", "versionType": "semver"}, {"status": "unaffected", "version": "6.8.2", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/iommu/intel/dmar.c", "drivers/iommu/intel/iommu.c", "drivers/iommu/intel/iommu.h", "drivers/iommu/intel/svm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15"}, {"url": "https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Use device rbtree in iopf reporting path\n\nThe existing I/O page fault handler currently locates the PCI device by\ncalling pci_get_domain_bus_and_slot(). This function searches the list\nof all PCI devices until the desired device is found. To improve lookup\nefficiency, replace it with device_rbtree_find() to search the device\nwithin the probed device rbtree.\n\nThe I/O page fault is initiated by the device, which does not have any\nsynchronization mechanism with the software to ensure that the device\nstays in the probed device tree. Theoretically, a device could be released\nby the IOMMU subsystem after device_rbtree_find() and before\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\n\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\nrelease device path. This lock doesn't introduce any performance overhead,\nas the conflict between I/O page fault reporting and device releasing is\nvery rare."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.2", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "6.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:15.505Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35843", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:30:15.505Z", "dateReserved": "2024-05-17T13:50:33.104Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-17T14:40:10.747Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iommu/intel/dmar.c", "drivers/iommu/intel/iommu.c", "drivers/iommu/intel/iommu.h", "drivers/iommu/intel/svm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3d39238991e745c5df85785604f037f35d9d1b15", "status": "affected", "version": "06f4b8d09dbabec631ed7b033f5d5413d86c7134", "versionType": "git"}, {"lessThan": "def054b01a867822254e1dda13d587f5c7a99e2a", "status": "affected", "version": "06f4b8d09dbabec631ed7b033f5d5413d86c7134", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iommu/intel/dmar.c", "drivers/iommu/intel/iommu.c", "drivers/iommu/intel/iommu.h", "drivers/iommu/intel/svm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "3d39238991e7", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "def054b01a86", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.2", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"status": "unaffected", "version": "6.9"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6402FBC3-9412-48E2-992D-DA529B4CF698", "versionEndExcluding": "6.8.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Use device rbtree in iopf reporting path\n\nThe existing I/O page fault handler currently locates the PCI device by\ncalling pci_get_domain_bus_and_slot(). This function searches the list\nof all PCI devices until the desired device is found. To improve lookup\nefficiency, replace it with device_rbtree_find() to search the device\nwithin the probed device rbtree.\n\nThe I/O page fault is initiated by the device, which does not have any\nsynchronization mechanism with the software to ensure that the device\nstays in the probed device tree. Theoretically, a device could be released\nby the IOMMU subsystem after device_rbtree_find() and before\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\n\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\nrelease device path. This lock doesn't introduce any performance overhead,\nas the conflict between I/O page fault reporting and device releasing is\nvery rare."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iommu/vt-d: use el rbtree del dispositivo en la ruta de informes iopf. El controlador de fallos de la p\u00e1gina de E/S existente actualmente ubica el dispositivo PCI llamando a pci_get_domain_bus_and_slot(). Esta funci\u00f3n busca en la lista de todos los dispositivos PCI hasta encontrar el dispositivo deseado. Para mejorar la eficiencia de la b\u00fasqueda, reempl\u00e1celo con device_rbtree_find() para buscar el dispositivo dentro del rbtree del dispositivo probado. El fallo de la p\u00e1gina de E/S la inicia el dispositivo, que no tiene ning\u00fan mecanismo de sincronizaci\u00f3n con el software para garantizar que el dispositivo permanezca en el \u00e1rbol de dispositivos analizados. En teor\u00eda, el subsistema IOMMU podr\u00eda liberar un dispositivo despu\u00e9s de device_rbtree_find() y antes de iopf_get_dev_fault_param(), lo que causar\u00eda un problema de uso despu\u00e9s de la liberaci\u00f3n. Agregue un mutex para sincronizar la ruta de informe de fallos de la p\u00e1gina de E/S y la ruta del dispositivo de liberaci\u00f3n IOMMU. Este bloqueo no introduce ninguna sobrecarga de rendimiento, ya que el conflicto entre el informe de fallos de la p\u00e1gina de E/S y la liberaci\u00f3n del dispositivo es muy raro."}], "id": "CVE-2024-35843", "lastModified": "2026-08-04T11:17:58.293", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35843", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-04T19:36:46.083168Z", "version": "2.0.3"}}]}, "published": "2024-05-17T15:15:21.313", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: iommu/vt-d: Use device rbtree in iopf reporting path", "id": "2281276", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281276"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\niommu/vt-d: Use device rbtree in iopf reporting path\nThe existing I/O page fault handler currently locates the PCI device by\ncalling pci_get_domain_bus_and_slot(). This function searches the list\nof all PCI devices until the desired device is found. To improve lookup\nefficiency, replace it with device_rbtree_find() to search the device\nwithin the probed device rbtree.\nThe I/O page fault is initiated by the device, which does not have any\nsynchronization mechanism with the software to ensure that the device\nstays in the probed device tree. Theoretically, a device could be released\nby the IOMMU subsystem after device_rbtree_find() and before\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\nrelease device path. This lock doesn't introduce any performance overhead,\nas the conflict between I/O page fault reporting and device releasing is\nvery rare."], "name": "CVE-2024-35843", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35843\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35843\nhttps://lore.kernel.org/linux-cve-announce/2024051717-CVE-2024-35843-516e@gregkh/T"], "threat_severity": "Low"}

{}