CVE-2024-27030

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-27030", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.211Z", "datePublished": "2024-05-01T12:53:25.954Z", "dateUpdated": "2026-08-05T11:29:07.771Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:07.771Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Use separate handlers for interrupts\n\nFor PF to AF interrupt vector and VF to AF vector same\ninterrupt handler is registered which is causing race condition.\nWhen two interrupts are raised to two CPUs at same time\nthen two cores serve same event corrupting the data."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is an MSI-X interrupt handler in the OcteonTX2 RVU admin-function driver, reached by writing the mailbox doorbell from a local PF/VF function (ethtool/netdev operations, or a VFIO-assigned VF), not by processing any remote network data. No packet-processing path leads here, so exploitation requires local access to the host or to a passed-through VF.\nAC:L - The attacker drives both sides of the race himself \u2014 one thread spamming PF\u2192AF mailbox messages (e.g. unprivileged `ethtool -a`, which issues `cgx_cfg_pause_frm`) while another spams the VF\u2192AF doorbell on a separate MSI-X vector affined to a different CPU. No condition outside the attacker's control is required, and the race can be retried indefinitely at high rate.\nPR:L - Generating AF mailbox traffic needs only an ordinary local account \u2014 several octeontx2 ethtool GET operations (`get_pauseparam`, `get_fecparam`) send mailbox messages with no capability check \u2014 or possession of an SR-IOV VF exposed to a container/guest, which can write the mailbox trigger register directly. No root or CAP_NET_ADMIN in the initial namespace is required.\nUI:N - The attacker triggers both interrupt vectors entirely on his own by issuing ethtool/netdev requests and mailbox doorbell writes. No administrator or victim action is needed at any point.\nS:U - The corrupted mailbox bookkeeping and the resulting out-of-bounds accesses are all inside the host kernel, the same security authority as the vulnerable RVU AF driver. No hypervisor, IOMMU, or sandbox boundary is crossed by the corruption itself.\nC:H - When the concurrently-bumped `num_msgs` extends the loop in `__rvu_mbox_handler()` past the valid message list, `msg` is taken from unvalidated memory and `offset` is advanced by an unchecked 16-bit `next_msgoff`, producing out-of-bounds reads outside the 64 KB `ioremap_wc()` mailbox window whose contents are then acted on and echoed back in mailbox responses \u2014 an unbounded kernel read primitive.\nI:H - The same overrun performs an unconditional write (`msg->pcifunc &= ...; msg->pcifunc |= ...`) at the attacker-influenced out-of-bounds offset before any signature validation, and the duplicate work-queue dispatch re-executes already-completed AF resource commands such as LF free/detach against released state, corrupting the admin function's resource tables.\nA:H - Duplicate processing of resource-teardown mailbox messages and out-of-range accesses to the ioremapped mailbox region readily oops the kernel, while the mutually-cleared interrupt bits drop mailbox events and wedge the AF\u2194PF/VF control plane, taking down all NIX/NPA networking on the SoC."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/af/rvu.c"], "versions": [{"version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2", "status": "affected", "versionType": "git"}, {"version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "766c2627acb2d9d1722cce2e24837044d52d888a", "status": "affected", "versionType": "git"}, {"version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "772f18ded0e240cc1fa2b7020cc640e3e5c32b70", "status": "affected", "versionType": "git"}, {"version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44", "status": "affected", "versionType": "git"}, {"version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "dc29dd00705a62c77de75b6d752259b869aac49d", "status": "affected", "versionType": "git"}, {"version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "ad6759e233db6fcc131055f8e23b4eafbe81053c", "status": "affected", "versionType": "git"}, {"version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701", "status": "affected", "versionType": "git"}, {"version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "50e60de381c342008c0956fd762e1c26408f372c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/af/rvu.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.273", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.214", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.153", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.83", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.23", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.11", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.2", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.4.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.214"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.7.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.8.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2"}, {"url": "https://git.kernel.org/stable/c/766c2627acb2d9d1722cce2e24837044d52d888a"}, {"url": "https://git.kernel.org/stable/c/772f18ded0e240cc1fa2b7020cc640e3e5c32b70"}, {"url": "https://git.kernel.org/stable/c/29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44"}, {"url": "https://git.kernel.org/stable/c/dc29dd00705a62c77de75b6d752259b869aac49d"}, {"url": "https://git.kernel.org/stable/c/ad6759e233db6fcc131055f8e23b4eafbe81053c"}, {"url": "https://git.kernel.org/stable/c/4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701"}, {"url": "https://git.kernel.org/stable/c/50e60de381c342008c0956fd762e1c26408f372c"}], "title": "octeontx2-af: Use separate handlers for interrupts", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.937Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/766c2627acb2d9d1722cce2e24837044d52d888a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/772f18ded0e240cc1fa2b7020cc640e3e5c32b70", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/dc29dd00705a62c77de75b6d752259b869aac49d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ad6759e233db6fcc131055f8e23b4eafbe81053c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/50e60de381c342008c0956fd762e1c26408f372c", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27030", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:44:21.007612Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:33.167Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/766c2627acb2d9d1722cce2e24837044d52d888a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/772f18ded0e240cc1fa2b7020cc640e3e5c32b70", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/dc29dd00705a62c77de75b6d752259b869aac49d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ad6759e233db6fcc131055f8e23b4eafbe81053c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/50e60de381c342008c0956fd762e1c26408f372c", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.937Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27030", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:44:21.007612Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:17.285Z"}}], "cna": {"title": "octeontx2-af: Use separate handlers for interrupts", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is an MSI-X interrupt handler in the OcteonTX2 RVU admin-function driver, reached by writing the mailbox doorbell from a local PF/VF function (ethtool/netdev operations, or a VFIO-assigned VF), not by processing any remote network data. No packet-processing path leads here, so exploitation requires local access to the host or to a passed-through VF.\nAC:L - The attacker drives both sides of the race himself \u2014 one thread spamming PF\u2192AF mailbox messages (e.g. unprivileged `ethtool -a`, which issues `cgx_cfg_pause_frm`) while another spams the VF\u2192AF doorbell on a separate MSI-X vector affined to a different CPU. No condition outside the attacker's control is required, and the race can be retried indefinitely at high rate.\nPR:L - Generating AF mailbox traffic needs only an ordinary local account \u2014 several octeontx2 ethtool GET operations (`get_pauseparam`, `get_fecparam`) send mailbox messages with no capability check \u2014 or possession of an SR-IOV VF exposed to a container/guest, which can write the mailbox trigger register directly. No root or CAP_NET_ADMIN in the initial namespace is required.\nUI:N - The attacker triggers both interrupt vectors entirely on his own by issuing ethtool/netdev requests and mailbox doorbell writes. No administrator or victim action is needed at any point.\nS:U - The corrupted mailbox bookkeeping and the resulting out-of-bounds accesses are all inside the host kernel, the same security authority as the vulnerable RVU AF driver. No hypervisor, IOMMU, or sandbox boundary is crossed by the corruption itself.\nC:H - When the concurrently-bumped `num_msgs` extends the loop in `__rvu_mbox_handler()` past the valid message list, `msg` is taken from unvalidated memory and `offset` is advanced by an unchecked 16-bit `next_msgoff`, producing out-of-bounds reads outside the 64 KB `ioremap_wc()` mailbox window whose contents are then acted on and echoed back in mailbox responses \u2014 an unbounded kernel read primitive.\nI:H - The same overrun performs an unconditional write (`msg->pcifunc &= ...; msg->pcifunc |= ...`) at the attacker-influenced out-of-bounds offset before any signature validation, and the duplicate work-queue dispatch re-executes already-completed AF resource commands such as LF free/detach against released state, corrupting the admin function's resource tables.\nA:H - Duplicate processing of resource-teardown mailbox messages and out-of-range accesses to the ioremapped mailbox region readily oops the kernel, while the mutually-cleared interrupt bits drop mailbox events and wedge the AF\u2194PF/VF control plane, taking down all NIX/NPA networking on the SoC."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2", "versionType": "git"}, {"status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "766c2627acb2d9d1722cce2e24837044d52d888a", "versionType": "git"}, {"status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "772f18ded0e240cc1fa2b7020cc640e3e5c32b70", "versionType": "git"}, {"status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44", "versionType": "git"}, {"status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "dc29dd00705a62c77de75b6d752259b869aac49d", "versionType": "git"}, {"status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "ad6759e233db6fcc131055f8e23b4eafbe81053c", "versionType": "git"}, {"status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701", "versionType": "git"}, {"status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "lessThan": "50e60de381c342008c0956fd762e1c26408f372c", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/marvell/octeontx2/af/rvu.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"status": "unaffected", "version": "0", "lessThan": "4.20", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.273", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.214", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.153", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.83", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.23", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.11", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8.2", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/marvell/octeontx2/af/rvu.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2"}, {"url": "https://git.kernel.org/stable/c/766c2627acb2d9d1722cce2e24837044d52d888a"}, {"url": "https://git.kernel.org/stable/c/772f18ded0e240cc1fa2b7020cc640e3e5c32b70"}, {"url": "https://git.kernel.org/stable/c/29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44"}, {"url": "https://git.kernel.org/stable/c/dc29dd00705a62c77de75b6d752259b869aac49d"}, {"url": "https://git.kernel.org/stable/c/ad6759e233db6fcc131055f8e23b4eafbe81053c"}, {"url": "https://git.kernel.org/stable/c/4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701"}, {"url": "https://git.kernel.org/stable/c/50e60de381c342008c0956fd762e1c26408f372c"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Use separate handlers for interrupts\n\nFor PF to AF interrupt vector and VF to AF vector same\ninterrupt handler is registered which is causing race condition.\nWhen two interrupts are raised to two CPUs at same time\nthen two cores serve same event corrupting the data."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.273", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.214", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.153", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.83", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.23", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.11", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.2", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "4.20"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:07.771Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27030", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:29:07.771Z", "dateReserved": "2024-02-19T14:20:24.211Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-01T12:53:25.954Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/af/rvu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2", "status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "versionType": "git"}, {"lessThan": "766c2627acb2d9d1722cce2e24837044d52d888a", "status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "versionType": "git"}, {"lessThan": "772f18ded0e240cc1fa2b7020cc640e3e5c32b70", "status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "versionType": "git"}, {"lessThan": "29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44", "status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "versionType": "git"}, {"lessThan": "dc29dd00705a62c77de75b6d752259b869aac49d", "status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "versionType": "git"}, {"lessThan": "ad6759e233db6fcc131055f8e23b4eafbe81053c", "status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "versionType": "git"}, {"lessThan": "4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701", "status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "versionType": "git"}, {"lessThan": "50e60de381c342008c0956fd762e1c26408f372c", "status": "affected", "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/af/rvu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.273", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.214", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.153", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.83", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.23", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.11", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "620FD8B7-BF03-43E0-951A-0A58461D4C55", "versionEndExcluding": "5.4.273", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "65987874-467B-4D3B-91D6-68A129B34FB8", "versionEndExcluding": "5.10.214", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACB69438-845D-4E3C-B114-3140611F9C0B", "versionEndExcluding": "5.15.153", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "121A07F6-F505-4C47-86BF-9BB6CC7B6C19", "versionEndExcluding": "6.1.83", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E00814DC-0BA7-431A-9926-80FEB4A96C68", "versionEndExcluding": "6.6.23", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD", "versionEndExcluding": "6.7.11", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "543A75FF-25B8-4046-A514-1EA8EDD87AB1", "versionEndExcluding": "6.8.2", "versionStartIncluding": "6.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Use separate handlers for interrupts\n\nFor PF to AF interrupt vector and VF to AF vector same\ninterrupt handler is registered which is causing race condition.\nWhen two interrupts are raised to two CPUs at same time\nthen two cores serve same event corrupting the data."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: octeontx2-af: utilice controladores separados para las interrupciones. Para el vector de interrupci\u00f3n PF a AF y el vector VF a AF, se registra el mismo controlador de interrupciones, lo que provoca la condici\u00f3n de ejecuci\u00f3n. Cuando se generan dos interrupciones en dos CPU al mismo tiempo, dos n\u00facleos atienden el mismo evento y corrompen los datos."}], "id": "CVE-2024-27030", "lastModified": "2026-08-04T11:17:36.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-27030", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:44:21.007612Z", "version": "2.0.3"}}]}, "published": "2024-05-01T13:15:49.137", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/50e60de381c342008c0956fd762e1c26408f372c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/766c2627acb2d9d1722cce2e24837044d52d888a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/772f18ded0e240cc1fa2b7020cc640e3e5c32b70"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ad6759e233db6fcc131055f8e23b4eafbe81053c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dc29dd00705a62c77de75b6d752259b869aac49d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/50e60de381c342008c0956fd762e1c26408f372c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/766c2627acb2d9d1722cce2e24837044d52d888a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/772f18ded0e240cc1fa2b7020cc640e3e5c32b70"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ad6759e233db6fcc131055f8e23b4eafbe81053c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dc29dd00705a62c77de75b6d752259b869aac49d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:4928", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.28.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-07-31T00:00:00Z"}, {"advisory": "RHSA-2024:4928", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.28.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-07-31T00:00:00Z"}, {"advisory": "RHSA-2024:5066", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.77.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-08-07T00:00:00Z"}, {"advisory": "RHSA-2024:5067", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.77.1.rt14.362.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-08-07T00:00:00Z"}], "bugzilla": {"description": "kernel: octeontx2-af: race condition on interupts", "id": "2278473", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2278473"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nocteontx2-af: Use separate handlers for interrupts\nFor PF to AF interrupt vector and VF to AF vector same\ninterrupt handler is registered which is causing race condition.\nWhen two interrupts are raised to two CPUs at same time\nthen two cores serve same event corrupting the data.", "A race condition vulnerability was found in the Linux kernel. When AF and PF interrupts are raised at the same time in the CPU, two cores serve same event, corrupting the data."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-27030", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-27030\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-27030\nhttps://lore.kernel.org/linux-cve-announce/2024050110-CVE-2024-27030-d75a@gregkh/T"], "threat_severity": "Moderate"}

{}