CVE-2024-40970

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-40970
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-40970.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-40970
Downstream
Related
Published
2024-07-12T12:32:08.788Z
Modified
2025-11-28T02:34:05.726265Z
Summary
Avoid hw_desc array overrun in dw-axi-dmac
Details

In the Linux kernel, the following vulnerability has been resolved:

Avoid hw_desc array overrun in dw-axi-dmac

I have a use case where nrbuffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descsallocated to be 9. Since axidescput() handles the hwdesc considering the descsallocated, this scenario would result in a kernel panic (hw_desc array will be overrun).

To fix this, the proposal is to add a new member to the axidmadesc structure, where we keep the number of allocated hwdescs (axidescalloc()) and use it in axidescput() to handle the hwdesc array correctly.

Additionally I propose to remove the axichanstartfirstqueued() call after completing the transfer, since it was identified that unbalance can occur (started descriptors can be interrupted and transfer ignored due to DMA channel not being enabled).

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40970.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Fixed
7c3bb96a20cd8db3b8824b2ff08b6cde4505c7e5
Fixed
dd42570018f5962c10f215ad9c21274ed5d3541e
Fixed
e151ae1ee065cf4b8ce4394ddb9d9c8df6370c66
Fixed
9004784e8d68bcd1ac1376407ba296fa28f04dbe
Fixed
333e11bf47fa8d477db90e2900b1ed3c9ae9b697

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.15.162
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.96
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.36
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.9.7