CVE-2024-43856

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-43856", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-17T09:11:59.278Z", "datePublished": "2024-08-17T09:24:26.560Z", "dateUpdated": "2026-10-15T00:48:27.417Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:49.175Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma: fix call order in dmam_free_coherent\n\ndmam_free_coherent() frees a DMA allocation, which makes the\nfreed vaddr available for reuse, then calls devres_destroy()\nto remove and free the data structure used to track the DMA\nallocation. Between the two calls, it is possible for a\nconcurrent task to make an allocation with the same vaddr\nand add it to the devres list.\n\nIf this happens, there will be two entries in the devres list\nwith the same vaddr and devres_destroy() can free the wrong\nentry, triggering the WARN_ON() in dmam_match.\n\nFix by destroying the devres entry before freeing the DMA\nallocation.\n\n kokonut //net/encryption\n http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - `dmam_free_coherent()` is a driver-internal managed-DMA helper reached only by locally driving a driver's DMA alloc/free path (ALSA PCM open/close, FireWire `/dev/fw*` ioctl, ethtool ring reconfig, bind/unbind). No remote peer data or packet-processing path drives it.\nAC:L - The attacker controls both sides of the race \u2014 two threads hammering alloc and free on the same `struct device` \u2014 and can retry indefinitely, while the LIFO behaviour of the page allocator makes the freed vaddr very likely to be handed straight back to the concurrent allocation. Nothing required is outside the attacker's influence.\nPR:L - An ordinary unprivileged local user with access to the relevant device node can drive it: `sprd_pcm_open()`/`sprd_pcm_close()` do `dmam_alloc_coherent()`/`dmam_free_coherent()` on the shared `component->dev` for every PCM open/close, and `/dev/fw*` ioctls trigger the FireWire config-ROM alloc while the bus-reset work item frees concurrently. No capability or root is needed on those paths.\nUI:N - The attacker's own threads create the race entirely; no victim action, mount, or file open by another user is required.\nS:U - The corrupted devres list, the DMA allocator state, and the resulting freed memory all belong to the kernel itself, so the impact stays within the vulnerable component's security authority.\nC:H - The stale devres entry causes `dma_free_attrs()` on a live buffer at driver detach, so the pages are recycled into arbitrary kernel objects while the original owner and the device still read them, yielding an arbitrary kernel-memory disclosure primitive.\nI:H - The wrong-entry destruction produces a double-free/UAF of DMA-coherent memory with a mismatched size and dma_handle, leaving a device with a stale IOVA mapping and the allocator writing into recycled pages \u2014 a heap-corruption and arbitrary-write primitive suitable for control-flow hijack.\nA:H - The immediate observable effect is the `WARN_ON()` in `dmam_match()`/`dmam_free_coherent()`, which panics the box under `panic_on_warn`, and the subsequent DMA double-free reliably oopses the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/dma/mapping.c"], "versions": [{"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "fe2d246080f035e0af5793cb79067ba125e4fb63", "status": "affected", "versionType": "git"}, {"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "2f7bbdc744f2e7051d1cb47c8e082162df1923c9", "status": "affected", "versionType": "git"}, {"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "257193083e8f43907e99ea633820fc2b3bcd24c7", "status": "affected", "versionType": "git"}, {"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "87b34c8c94e29fa01d744e5147697f592998d954", "status": "affected", "versionType": "git"}, {"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "f993a4baf6b622232e4c190d34c220179e5d61eb", "status": "affected", "versionType": "git"}, {"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "1fe97f68fce1ba24bf823bfb0eb0956003473130", "status": "affected", "versionType": "git"}, {"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "22094f5f52e7bc16c5bf9613365049383650b02e", "status": "affected", "versionType": "git"}, {"version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "28e8b7406d3a1f5329a03aa25a43aa28e087cb20", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/dma/mapping.c"], "versions": [{"version": "2.6.21", "status": "affected"}, {"version": "0", "lessThan": "2.6.21", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.320", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.282", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.224", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.165", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.103", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.44", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.3", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "4.19.320"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "5.4.282"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "5.10.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "5.15.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "6.1.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "6.6.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "6.10.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.21", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fe2d246080f035e0af5793cb79067ba125e4fb63"}, {"url": "https://git.kernel.org/stable/c/2f7bbdc744f2e7051d1cb47c8e082162df1923c9"}, {"url": "https://git.kernel.org/stable/c/257193083e8f43907e99ea633820fc2b3bcd24c7"}, {"url": "https://git.kernel.org/stable/c/87b34c8c94e29fa01d744e5147697f592998d954"}, {"url": "https://git.kernel.org/stable/c/f993a4baf6b622232e4c190d34c220179e5d61eb"}, {"url": "https://git.kernel.org/stable/c/1fe97f68fce1ba24bf823bfb0eb0956003473130"}, {"url": "https://git.kernel.org/stable/c/22094f5f52e7bc16c5bf9613365049383650b02e"}, {"url": "https://git.kernel.org/stable/c/28e8b7406d3a1f5329a03aa25a43aa28e087cb20"}], "title": "dma: fix call order in dmam_free_coherent", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43856", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:07:08.178694Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:20.523Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:05:56.178Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:48:27.417Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:05:56.178Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:48:27.417Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43856", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:07:08.178694Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:22.874Z"}}], "cna": {"title": "dma: fix call order in dmam_free_coherent", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - `dmam_free_coherent()` is a driver-internal managed-DMA helper reached only by locally driving a driver's DMA alloc/free path (ALSA PCM open/close, FireWire `/dev/fw*` ioctl, ethtool ring reconfig, bind/unbind). No remote peer data or packet-processing path drives it.\nAC:L - The attacker controls both sides of the race \u2014 two threads hammering alloc and free on the same `struct device` \u2014 and can retry indefinitely, while the LIFO behaviour of the page allocator makes the freed vaddr very likely to be handed straight back to the concurrent allocation. Nothing required is outside the attacker's influence.\nPR:L - An ordinary unprivileged local user with access to the relevant device node can drive it: `sprd_pcm_open()`/`sprd_pcm_close()` do `dmam_alloc_coherent()`/`dmam_free_coherent()` on the shared `component->dev` for every PCM open/close, and `/dev/fw*` ioctls trigger the FireWire config-ROM alloc while the bus-reset work item frees concurrently. No capability or root is needed on those paths.\nUI:N - The attacker's own threads create the race entirely; no victim action, mount, or file open by another user is required.\nS:U - The corrupted devres list, the DMA allocator state, and the resulting freed memory all belong to the kernel itself, so the impact stays within the vulnerable component's security authority.\nC:H - The stale devres entry causes `dma_free_attrs()` on a live buffer at driver detach, so the pages are recycled into arbitrary kernel objects while the original owner and the device still read them, yielding an arbitrary kernel-memory disclosure primitive.\nI:H - The wrong-entry destruction produces a double-free/UAF of DMA-coherent memory with a mismatched size and dma_handle, leaving a device with a stale IOVA mapping and the allocator writing into recycled pages \u2014 a heap-corruption and arbitrary-write primitive suitable for control-flow hijack.\nA:H - The immediate observable effect is the `WARN_ON()` in `dmam_match()`/`dmam_free_coherent()`, which panics the box under `panic_on_warn`, and the subsequent DMA double-free reliably oopses the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "fe2d246080f035e0af5793cb79067ba125e4fb63", "versionType": "git"}, {"status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "2f7bbdc744f2e7051d1cb47c8e082162df1923c9", "versionType": "git"}, {"status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "257193083e8f43907e99ea633820fc2b3bcd24c7", "versionType": "git"}, {"status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "87b34c8c94e29fa01d744e5147697f592998d954", "versionType": "git"}, {"status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "f993a4baf6b622232e4c190d34c220179e5d61eb", "versionType": "git"}, {"status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "1fe97f68fce1ba24bf823bfb0eb0956003473130", "versionType": "git"}, {"status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "22094f5f52e7bc16c5bf9613365049383650b02e", "versionType": "git"}, {"status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "lessThan": "28e8b7406d3a1f5329a03aa25a43aa28e087cb20", "versionType": "git"}], "programFiles": ["kernel/dma/mapping.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.21"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.21", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.320", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.282", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.224", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.165", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.103", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.44", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.3", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/dma/mapping.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/fe2d246080f035e0af5793cb79067ba125e4fb63"}, {"url": "https://git.kernel.org/stable/c/2f7bbdc744f2e7051d1cb47c8e082162df1923c9"}, {"url": "https://git.kernel.org/stable/c/257193083e8f43907e99ea633820fc2b3bcd24c7"}, {"url": "https://git.kernel.org/stable/c/87b34c8c94e29fa01d744e5147697f592998d954"}, {"url": "https://git.kernel.org/stable/c/f993a4baf6b622232e4c190d34c220179e5d61eb"}, {"url": "https://git.kernel.org/stable/c/1fe97f68fce1ba24bf823bfb0eb0956003473130"}, {"url": "https://git.kernel.org/stable/c/22094f5f52e7bc16c5bf9613365049383650b02e"}, {"url": "https://git.kernel.org/stable/c/28e8b7406d3a1f5329a03aa25a43aa28e087cb20"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma: fix call order in dmam_free_coherent\n\ndmam_free_coherent() frees a DMA allocation, which makes the\nfreed vaddr available for reuse, then calls devres_destroy()\nto remove and free the data structure used to track the DMA\nallocation. Between the two calls, it is possible for a\nconcurrent task to make an allocation with the same vaddr\nand add it to the devres list.\n\nIf this happens, there will be two entries in the devres list\nwith the same vaddr and devres_destroy() can free the wrong\nentry, triggering the WARN_ON() in dmam_match.\n\nFix by destroying the devres entry before freeing the DMA\nallocation.\n\n kokonut //net/encryption\n http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.320", "versionStartIncluding": "2.6.21"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.282", "versionStartIncluding": "2.6.21"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.224", "versionStartIncluding": "2.6.21"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.165", "versionStartIncluding": "2.6.21"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.103", "versionStartIncluding": "2.6.21"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.44", "versionStartIncluding": "2.6.21"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.3", "versionStartIncluding": "2.6.21"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "2.6.21"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:49.175Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43856", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:48:27.417Z", "dateReserved": "2024-08-17T09:11:59.278Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-17T09:24:26.560Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/dma/mapping.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fe2d246080f035e0af5793cb79067ba125e4fb63", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git"}, {"lessThan": "2f7bbdc744f2e7051d1cb47c8e082162df1923c9", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git"}, {"lessThan": "257193083e8f43907e99ea633820fc2b3bcd24c7", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git"}, {"lessThan": "87b34c8c94e29fa01d744e5147697f592998d954", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git"}, {"lessThan": "f993a4baf6b622232e4c190d34c220179e5d61eb", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git"}, {"lessThan": "1fe97f68fce1ba24bf823bfb0eb0956003473130", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git"}, {"lessThan": "22094f5f52e7bc16c5bf9613365049383650b02e", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git"}, {"lessThan": "28e8b7406d3a1f5329a03aa25a43aa28e087cb20", "status": "affected", "version": "9ac7849e35f705830f7b016ff272b0ff1f7ff759", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/dma/mapping.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.21"}, {"lessThan": "2.6.21", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "482B11C0-6B3C-4F07-817D-E7E181A88878", "versionEndExcluding": "4.19.320", "versionStartIncluding": "2.6.21", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A8961D98-9ACF-4188-BA88-44038B14BC28", "versionEndExcluding": "5.4.282", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5CCEDF13-293D-4E64-B501-4409D0365AFE", "versionEndExcluding": "5.10.224", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4E2B568-3171-41DE-B519-F2B1A3600D94", "versionEndExcluding": "5.15.165", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E45EAC72-8329-4F99-8276-86AF9BB3496A", "versionEndExcluding": "6.1.103", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CC912330-6B41-4C6B-99AF-F3857FBACB6A", "versionEndExcluding": "6.6.44", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92D388F2-1EAF-4CFA-AC06-5B26D762EA7D", "versionEndExcluding": "6.10.3", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma: fix call order in dmam_free_coherent\n\ndmam_free_coherent() frees a DMA allocation, which makes the\nfreed vaddr available for reuse, then calls devres_destroy()\nto remove and free the data structure used to track the DMA\nallocation. Between the two calls, it is possible for a\nconcurrent task to make an allocation with the same vaddr\nand add it to the devres list.\n\nIf this happens, there will be two entries in the devres list\nwith the same vaddr and devres_destroy() can free the wrong\nentry, triggering the WARN_ON() in dmam_match.\n\nFix by destroying the devres entry before freeing the DMA\nallocation.\n\n kokonut //net/encryption\n http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03"}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: dma: corrige el orden de llamadas en dmam_free_coherent dmam_free_coherent() libera una asignaci\u00f3n de DMA, lo que hace que el vaddr liberado est\u00e9 disponible para su reutilizaci\u00f3n, luego llama a devres_destroy() para eliminar y liberar la estructura de datos utilizada para realizar un seguimiento de la asignaci\u00f3n de DMA. Entre las dos llamadas, es posible que una tarea simult\u00e1nea realice una asignaci\u00f3n con el mismo vaddr y lo agregue a la lista de devres. Si esto sucede, habr\u00e1 dos entradas en la lista devres con el mismo vaddr y devres_destroy() puede liberar la entrada incorrecta, activando WARN_ON() en dmam_match. Para solucionarlo, destruya la entrada devres antes de liberar la asignaci\u00f3n de DMA. kokonut //net/encryption http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03"}], "id": "CVE-2024-43856", "lastModified": "2026-10-15T01:18:47.923", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-43856", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:08.178694Z", "version": "2.0.3"}}]}, "published": "2024-08-17T10:15:10.613", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1fe97f68fce1ba24bf823bfb0eb0956003473130"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/22094f5f52e7bc16c5bf9613365049383650b02e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/257193083e8f43907e99ea633820fc2b3bcd24c7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/28e8b7406d3a1f5329a03aa25a43aa28e087cb20"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2f7bbdc744f2e7051d1cb47c8e082162df1923c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/87b34c8c94e29fa01d744e5147697f592998d954"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f993a4baf6b622232e4c190d34c220179e5d61eb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fe2d246080f035e0af5793cb79067ba125e4fb63"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: dma: fix call order in dmam_free_coherent", "id": "2305514", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305514"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-362", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndma: fix call order in dmam_free_coherent\ndmam_free_coherent() frees a DMA allocation, which makes the\nfreed vaddr available for reuse, then calls devres_destroy()\nto remove and free the data structure used to track the DMA\nallocation. Between the two calls, it is possible for a\nconcurrent task to make an allocation with the same vaddr\nand add it to the devres list.\nIf this happens, there will be two entries in the devres list\nwith the same vaddr and devres_destroy() can free the wrong\nentry, triggering the WARN_ON() in dmam_match.\nFix by destroying the devres entry before freeing the DMA\nallocation.\nkokonut //net/encryption\nhttp://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03"], "name": "CVE-2024-43856", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-43856\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-43856\nhttps://lore.kernel.org/linux-cve-announce/2024081732-CVE-2024-43856-9087@gregkh/T"], "statement": "Red Hat believes this vulnerability to be of moderate impact because elevated privileges are required to trigger this vulnerability, seeing as DMA is low-level memory management operation typically limited to kernel-mode operations, and drivers often need elevated privileges to interact with hardware.", "threat_severity": "Moderate"}

{}