Junglewise Threat Intelligence

CVE-2024-43856: Linux kernel race condition in dmam_free_coherent

CVE-2024-43856 · Severity: medium · CVSS 5.5 · Published 2024-08-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's memory management system could allow a local user to cause a system crash. The issue occurs when the system incorrectly handles the release of memory used for hardware communication, potentially leading to internal data corruption. This primarily impacts system stability and availability.

Technical details

A race condition exists in dmam_free_coherent() due to an incorrect call order between dma_free_coherent() and devres_destroy(). In the vulnerable versions, dma_free_coherent() is called first, making the virtual address (vaddr) available for immediate reuse. If a concurrent task allocates the same vaddr and adds it to the devres list before the original task calls devres_destroy(), the kernel may destroy the wrong devres entry. This triggers a WARN_ON in dmam_match and can lead to resource management errors. The fix reorders the calls to ensure the devres entry is destroyed before the DMA allocation is freed.

Affected products

  • Linux Linux kernel 2.6.21 to 4.19.320, 4.20 to 5.4.282, 5.5 to 5.10.224, 5.11 to 5.15.165, 5.16 to 6.1.103, 6.2 to 6.6.44, 6.7 to 6.10.3

Timeline

  • 2024-08-17: disclosed
  • 2024-08-17: advisory
  • 2024-07-19: patched: Initial patch in mainline kernel tree.

References

Related threats