CVE-2024-40991 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id() The of_k3_udma_glue_parse_chn_by_id() helper function erroneously invokes "of_node_put()" on the "udmax_np" device-node passed to it, without having incremented its reference count at any point. Fix it.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e
https://git.kernel.org/stable/c/ba27e9d2207784da748b19170a2e56bd7770bd81
https://lore.kernel.org/linux-cve-announce/2024071250-CVE-2024-40991-34b6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-40991
https://www.cve.org/CVERecord?id=CVE-2024-40991

History

Thu, 12 Sep 2024 08:30:00 +0000

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-07-12T12:37:35.138Z

Updated: 2024-11-05T09:34:38.108Z

Reserved: 2024-07-12T12:17:45.605Z

Link: CVE-2024-40991

Vulnrichment

Updated: 2024-08-02T04:39:56.059Z

NVD

Status : Awaiting Analysis

Published: 2024-07-12T13:15:20.430

Modified: 2024-07-12T16:34:58.687

Link: CVE-2024-40991

Redhat

Severity : Moderate

Publid Date: 2024-07-12T00:00:00Z

Links: CVE-2024-40991 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-40991", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.605Z", "datePublished": "2024-07-12T12:37:35.138Z", "dateUpdated": "2024-11-05T09:34:38.108Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:34:38.108Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()\n\nThe of_k3_udma_glue_parse_chn_by_id() helper function erroneously\ninvokes \"of_node_put()\" on the \"udmax_np\" device-node passed to it,\nwithout having incremented its reference count at any point. Fix it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/ti/k3-udma-glue.c"], "versions": [{"version": "81a1f90f20af", "lessThan": "a5ab5f413d1e", "status": "affected", "versionType": "git"}, {"version": "81a1f90f20af", "lessThan": "ba27e9d22077", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/ti/k3-udma-glue.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.7", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e"}, {"url": "https://git.kernel.org/stable/c/ba27e9d2207784da748b19170a2e56bd7770bd81"}], "title": "dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:56.059Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ba27e9d2207784da748b19170a2e56bd7770bd81", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:01:48.045329Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:20.263Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ba27e9d2207784da748b19170a2e56bd7770bd81", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:56.059Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:01:48.045329Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:22.072Z"}}], "cna": {"title": "dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "81a1f90f20af", "lessThan": "a5ab5f413d1e", "versionType": "git"}, {"status": "affected", "version": "81a1f90f20af", "lessThan": "ba27e9d22077", "versionType": "git"}], "programFiles": ["drivers/dma/ti/k3-udma-glue.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "custom"}, {"status": "unaffected", "version": "6.9.7", "versionType": "custom", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/dma/ti/k3-udma-glue.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e"}, {"url": "https://git.kernel.org/stable/c/ba27e9d2207784da748b19170a2e56bd7770bd81"}], "x_generator": {"engine": "bippy-c9c4e1df01b2"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()\n\nThe of_k3_udma_glue_parse_chn_by_id() helper function erroneously\ninvokes \"of_node_put()\" on the \"udmax_np\" device-node passed to it,\nwithout having incremented its reference count at any point. Fix it."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-15T06:52:56.046Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40991", "state": "PUBLISHED", "dateUpdated": "2024-09-11T17:34:20.263Z", "dateReserved": "2024-07-12T12:17:45.605Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:37:35.138Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()", "id": "2297575", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297575"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()\nThe of_k3_udma_glue_parse_chn_by_id() helper function erroneously\ninvokes \"of_node_put()\" on the \"udmax_np\" device-node passed to it,\nwithout having incremented its reference count at any point. Fix it.", "A vulnerability was found in the Linux kernel's DMA engine component due to an issue in the `of_k3_udma_glue_parse_chn_by_id()` helper function. It incorrectly invoked the `of_node_put()` function on the `udmax_np` device-node without first incrementing its reference count, which could lead to potential issues in resource management."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-40991", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-40991\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-40991\nhttps://lore.kernel.org/linux-cve-announce/2024071250-CVE-2024-40991-34b6@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate", "upstream_fix": "kernel 6.9.7, kernel 6.10-rc5"}