In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix freeing of the HMB descriptor table
The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but _nvmeallochostmem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dmafreecoherent.
In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page.
[
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-1b735acb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@582d9ed999b004fb1d415ecbfa86d4d8df455269",
"digest": {
"length": 678.0,
"function_hash": "273678821658520846131727408757745838605"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "nvme_free_host_mem"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-215a18c9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cee3bff51a35cab1c5d842d409a7b11caefe2386",
"digest": {
"length": 678.0,
"function_hash": "273678821658520846131727408757745838605"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "nvme_free_host_mem"
}
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2024-56756-26206f27",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@452f9ddd12bebc04cef741e8ba3806bf0e1fd015",
"digest": {
"line_hashes": [
"306991155250031312192460287756368412403",
"71488110654876668661484754508388140811",
"22914804255286716163915614993278548080",
"119079231560359800973135106254563849448",
"174492188467171328728399706752886019383",
"56598744052448039623578413476943661171",
"317777173466088389825957865661353829765",
"274874937263276934412805851078734493770",
"317604754449673567173058043183008194518",
"168275592277153524750185292563002857659",
"334336542503187352590398715881770119329",
"285495833357365540158198690190809888594",
"93157177205391545996845730771975798693",
"122292903703517486867107565547365301688",
"260172296777801415085275498869160429534",
"10530261249910835060956711368486414097",
"2012066097502236539864979613352432505",
"141710392096061890993265664229080144715",
"104299402632236412000633916494002887723",
"166307397438491431589366283392249822390",
"38681426646919876866348006501159782346",
"263097904960361996718244568623990840790",
"185445579591661421894461659501965596301",
"50500509360283516510164832655132708347",
"212410728249235939255218994067164017007",
"62944482527383734949913289358741969889",
"227627967843281756750392477765381499124",
"81739053306041242007330368313047623716",
"324292298333353705715277831361073912215"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2024-56756-2b76cec2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@582d9ed999b004fb1d415ecbfa86d4d8df455269",
"digest": {
"line_hashes": [
"306991155250031312192460287756368412403",
"71488110654876668661484754508388140811",
"22914804255286716163915614993278548080",
"119079231560359800973135106254563849448",
"174492188467171328728399706752886019383",
"56598744052448039623578413476943661171",
"317777173466088389825957865661353829765",
"274874937263276934412805851078734493770",
"317604754449673567173058043183008194518",
"168275592277153524750185292563002857659",
"334336542503187352590398715881770119329",
"285495833357365540158198690190809888594",
"93157177205391545996845730771975798693",
"122292903703517486867107565547365301688",
"260172296777801415085275498869160429534",
"10530261249910835060956711368486414097",
"2012066097502236539864979613352432505",
"141710392096061890993265664229080144715",
"104299402632236412000633916494002887723",
"166307397438491431589366283392249822390",
"38681426646919876866348006501159782346",
"263097904960361996718244568623990840790",
"185445579591661421894461659501965596301",
"50500509360283516510164832655132708347",
"212410728249235939255218994067164017007",
"62944482527383734949913289358741969889",
"227627967843281756750392477765381499124",
"81739053306041242007330368313047623716",
"324292298333353705715277831361073912215"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2024-56756-2df633da",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb96d5cfa97a7363245b3dd523f475b04296d87b",
"digest": {
"line_hashes": [
"306991155250031312192460287756368412403",
"71488110654876668661484754508388140811",
"22914804255286716163915614993278548080",
"119079231560359800973135106254563849448",
"174492188467171328728399706752886019383",
"56598744052448039623578413476943661171",
"317777173466088389825957865661353829765",
"274874937263276934412805851078734493770",
"317604754449673567173058043183008194518",
"168275592277153524750185292563002857659",
"334336542503187352590398715881770119329",
"285495833357365540158198690190809888594",
"93157177205391545996845730771975798693",
"122292903703517486867107565547365301688",
"260172296777801415085275498869160429534",
"10530261249910835060956711368486414097",
"2012066097502236539864979613352432505",
"141710392096061890993265664229080144715",
"104299402632236412000633916494002887723",
"166307397438491431589366283392249822390",
"38681426646919876866348006501159782346",
"263097904960361996718244568623990840790",
"185445579591661421894461659501965596301",
"50500509360283516510164832655132708347",
"212410728249235939255218994067164017007",
"62944482527383734949913289358741969889",
"227627967843281756750392477765381499124",
"81739053306041242007330368313047623716",
"324292298333353705715277831361073912215"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-3ea258e4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb96d5cfa97a7363245b3dd523f475b04296d87b",
"digest": {
"length": 678.0,
"function_hash": "273678821658520846131727408757745838605"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "nvme_free_host_mem"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-5d1fb10c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@452f9ddd12bebc04cef741e8ba3806bf0e1fd015",
"digest": {
"length": 1520.0,
"function_hash": "227189683995193592134465733791307135325"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "__nvme_alloc_host_mem"
}
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2024-56756-60e0d066",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d0f599db73b099aa724a12736369c4d4d92849d",
"digest": {
"line_hashes": [
"306991155250031312192460287756368412403",
"71488110654876668661484754508388140811",
"22914804255286716163915614993278548080",
"119079231560359800973135106254563849448",
"174492188467171328728399706752886019383",
"56598744052448039623578413476943661171",
"317777173466088389825957865661353829765",
"274874937263276934412805851078734493770",
"317604754449673567173058043183008194518",
"168275592277153524750185292563002857659",
"334336542503187352590398715881770119329",
"285495833357365540158198690190809888594",
"93157177205391545996845730771975798693",
"122292903703517486867107565547365301688",
"260172296777801415085275498869160429534",
"10530261249910835060956711368486414097",
"2012066097502236539864979613352432505",
"141710392096061890993265664229080144715",
"104299402632236412000633916494002887723",
"166307397438491431589366283392249822390",
"38681426646919876866348006501159782346",
"263097904960361996718244568623990840790",
"185445579591661421894461659501965596301",
"50500509360283516510164832655132708347",
"212410728249235939255218994067164017007",
"62944482527383734949913289358741969889",
"227627967843281756750392477765381499124",
"81739053306041242007330368313047623716",
"324292298333353705715277831361073912215"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-6c54ca5b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d0f599db73b099aa724a12736369c4d4d92849d",
"digest": {
"length": 678.0,
"function_hash": "273678821658520846131727408757745838605"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "nvme_free_host_mem"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-761e7f0c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d0f599db73b099aa724a12736369c4d4d92849d",
"digest": {
"length": 1520.0,
"function_hash": "227189683995193592134465733791307135325"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "__nvme_alloc_host_mem"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-851b2b73",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c2fb1ca8086eb139b2a551358137525ae8e0d7a",
"digest": {
"length": 1520.0,
"function_hash": "227189683995193592134465733791307135325"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "__nvme_alloc_host_mem"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-997dc597",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac22240540e0c5230d8c4138e3778420b712716a",
"digest": {
"length": 684.0,
"function_hash": "287964312429263017778927881948026776753"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "nvme_free_host_mem"
}
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2024-56756-b2147b74",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c2fb1ca8086eb139b2a551358137525ae8e0d7a",
"digest": {
"line_hashes": [
"306991155250031312192460287756368412403",
"71488110654876668661484754508388140811",
"22914804255286716163915614993278548080",
"119079231560359800973135106254563849448",
"174492188467171328728399706752886019383",
"56598744052448039623578413476943661171",
"317777173466088389825957865661353829765",
"274874937263276934412805851078734493770",
"317604754449673567173058043183008194518",
"168275592277153524750185292563002857659",
"334336542503187352590398715881770119329",
"285495833357365540158198690190809888594",
"93157177205391545996845730771975798693",
"122292903703517486867107565547365301688",
"260172296777801415085275498869160429534",
"10530261249910835060956711368486414097",
"2012066097502236539864979613352432505",
"141710392096061890993265664229080144715",
"104299402632236412000633916494002887723",
"166307397438491431589366283392249822390",
"38681426646919876866348006501159782346",
"263097904960361996718244568623990840790",
"185445579591661421894461659501965596301",
"50500509360283516510164832655132708347",
"212410728249235939255218994067164017007",
"62944482527383734949913289358741969889",
"227627967843281756750392477765381499124",
"81739053306041242007330368313047623716",
"324292298333353705715277831361073912215"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2024-56756-b34c4348",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac22240540e0c5230d8c4138e3778420b712716a",
"digest": {
"line_hashes": [
"306991155250031312192460287756368412403",
"71488110654876668661484754508388140811",
"22914804255286716163915614993278548080",
"119079231560359800973135106254563849448",
"174492188467171328728399706752886019383",
"56598744052448039623578413476943661171",
"317777173466088389825957865661353829765",
"274874937263276934412805851078734493770",
"317604754449673567173058043183008194518",
"168275592277153524750185292563002857659",
"334336542503187352590398715881770119329",
"285495833357365540158198690190809888594",
"93157177205391545996845730771975798693",
"122292903703517486867107565547365301688",
"260172296777801415085275498869160429534",
"10530261249910835060956711368486414097",
"2012066097502236539864979613352432505",
"141710392096061890993265664229080144715",
"104299402632236412000633916494002887723",
"166307397438491431589366283392249822390",
"38681426646919876866348006501159782346",
"263097904960361996718244568623990840790",
"185445579591661421894461659501965596301",
"50500509360283516510164832655132708347",
"212410728249235939255218994067164017007",
"62944482527383734949913289358741969889",
"227627967843281756750392477765381499124",
"81739053306041242007330368313047623716",
"324292298333353705715277831361073912215"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-b67e261d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb96d5cfa97a7363245b3dd523f475b04296d87b",
"digest": {
"length": 1520.0,
"function_hash": "227189683995193592134465733791307135325"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "__nvme_alloc_host_mem"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-bbc63e7c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@582d9ed999b004fb1d415ecbfa86d4d8df455269",
"digest": {
"length": 1520.0,
"function_hash": "227189683995193592134465733791307135325"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "__nvme_alloc_host_mem"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-c52f74a3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac22240540e0c5230d8c4138e3778420b712716a",
"digest": {
"length": 1532.0,
"function_hash": "246271551079139309303317723741584215846"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "__nvme_alloc_host_mem"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-dbee33dc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c2fb1ca8086eb139b2a551358137525ae8e0d7a",
"digest": {
"length": 678.0,
"function_hash": "273678821658520846131727408757745838605"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "nvme_free_host_mem"
}
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2024-56756-e6e9f98d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cee3bff51a35cab1c5d842d409a7b11caefe2386",
"digest": {
"line_hashes": [
"306991155250031312192460287756368412403",
"71488110654876668661484754508388140811",
"22914804255286716163915614993278548080",
"119079231560359800973135106254563849448",
"174492188467171328728399706752886019383",
"56598744052448039623578413476943661171",
"317777173466088389825957865661353829765",
"274874937263276934412805851078734493770",
"317604754449673567173058043183008194518",
"168275592277153524750185292563002857659",
"334336542503187352590398715881770119329",
"285495833357365540158198690190809888594",
"93157177205391545996845730771975798693",
"122292903703517486867107565547365301688",
"260172296777801415085275498869160429534",
"10530261249910835060956711368486414097",
"2012066097502236539864979613352432505",
"141710392096061890993265664229080144715",
"104299402632236412000633916494002887723",
"166307397438491431589366283392249822390",
"38681426646919876866348006501159782346",
"263097904960361996718244568623990840790",
"185445579591661421894461659501965596301",
"50500509360283516510164832655132708347",
"212410728249235939255218994067164017007",
"62944482527383734949913289358741969889",
"227627967843281756750392477765381499124",
"81739053306041242007330368313047623716",
"324292298333353705715277831361073912215"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-f75becd3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cee3bff51a35cab1c5d842d409a7b11caefe2386",
"digest": {
"length": 1520.0,
"function_hash": "227189683995193592134465733791307135325"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "__nvme_alloc_host_mem"
}
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2024-56756-fe00464d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@452f9ddd12bebc04cef741e8ba3806bf0e1fd015",
"digest": {
"length": 678.0,
"function_hash": "273678821658520846131727408757745838605"
},
"signature_version": "v1",
"target": {
"file": "drivers/nvme/host/pci.c",
"function": "nvme_free_host_mem"
}
}
]