| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024122928-CVE-2024-56756-32fb@gregkh> Date: Sun, 29 Dec 2024 12:29:49 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-56756: nvme-pci: fix freeing of the HMB descriptor table Description =========== In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix freeing of the HMB descriptor table The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent. In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page. The Linux kernel CVE team has assigned CVE-2024-56756 to this issue. Affected and fixed versions =========================== Issue introduced in 4.13 with commit 87ad72a59a38d1df217cfd95bc222a2edfe5d399 and fixed in 5.4.287 with commit ac22240540e0c5230d8c4138e3778420b712716a Issue introduced in 4.13 with commit 87ad72a59a38d1df217cfd95bc222a2edfe5d399 and fixed in 5.10.231 with commit 452f9ddd12bebc04cef741e8ba3806bf0e1fd015 Issue introduced in 4.13 with commit 87ad72a59a38d1df217cfd95bc222a2edfe5d399 and fixed in 5.15.174 with commit 869cf50b9c9d1059f5223f79ef68fc0bc6210095 Issue introduced in 4.13 with commit 87ad72a59a38d1df217cfd95bc222a2edfe5d399 and fixed in 6.1.120 with commit fb96d5cfa97a7363245b3dd523f475b04296d87b Issue introduced in 4.13 with commit 87ad72a59a38d1df217cfd95bc222a2edfe5d399 and fixed in 6.6.64 with commit cee3bff51a35cab1c5d842d409a7b11caefe2386 Issue introduced in 4.13 with commit 87ad72a59a38d1df217cfd95bc222a2edfe5d399 and fixed in 6.11.11 with commit 6d0f599db73b099aa724a12736369c4d4d92849d Issue introduced in 4.13 with commit 87ad72a59a38d1df217cfd95bc222a2edfe5d399 and fixed in 6.12.2 with commit 582d9ed999b004fb1d415ecbfa86d4d8df455269 Issue introduced in 4.13 with commit 87ad72a59a38d1df217cfd95bc222a2edfe5d399 and fixed in 6.13-rc1 with commit 3c2fb1ca8086eb139b2a551358137525ae8e0d7a Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-56756 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/nvme/host/pci.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ac22240540e0c5230d8c4138e3778420b712716a https://git.kernel.org/stable/c/452f9ddd12bebc04cef741e8ba3806bf0e1fd015 https://git.kernel.org/stable/c/869cf50b9c9d1059f5223f79ef68fc0bc6210095 https://git.kernel.org/stable/c/fb96d5cfa97a7363245b3dd523f475b04296d87b https://git.kernel.org/stable/c/cee3bff51a35cab1c5d842d409a7b11caefe2386 https://git.kernel.org/stable/c/6d0f599db73b099aa724a12736369c4d4d92849d https://git.kernel.org/stable/c/582d9ed999b004fb1d415ecbfa86d4d8df455269 https://git.kernel.org/stable/c/3c2fb1ca8086eb139b2a551358137525ae8e0d7a
Powered by blists - more mailing lists