CVE-2024-27409 (GCVE-0-2024-27409)

Vulnerability from cvelistv5 – Published: 2024-05-17 11:50 – Updated: 2026-08-05 11:29
VLAI
Title
dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup The Linked list element and pointer are not stored in the same memory as the HDMA controller register. If the doorbell register is toggled before the full write of the linked list a race condition error will occur. In remote setup we can only use a readl to the memory to assure the full write has occurred.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-20 17:32 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e74c39573d35e9ac441090ff8183aa3dc2540649 , < 227ef58a9b0c372efba422e8886a8015a1509eba (git)
Affected: e74c39573d35e9ac441090ff8183aa3dc2540649 , < 17be6f5cb223f22e4733ed8fe8b2247cbb677716 (git)
Affected: e74c39573d35e9ac441090ff8183aa3dc2540649 , < 712a92a48158e02155b4b6b21e03a817f78c9b7e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.21 , ≤ 6.6.* (semver)
Unaffected: 6.7.9 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27409",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T17:32:55.652133Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:46:17.954Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:34:52.290Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/227ef58a9b0c372efba422e8886a8015a1509eba"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/17be6f5cb223f22e4733ed8fe8b2247cbb677716"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/712a92a48158e02155b4b6b21e03a817f78c9b7e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/dw-edma/dw-hdma-v0-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "227ef58a9b0c372efba422e8886a8015a1509eba",
              "status": "affected",
              "version": "e74c39573d35e9ac441090ff8183aa3dc2540649",
              "versionType": "git"
            },
            {
              "lessThan": "17be6f5cb223f22e4733ed8fe8b2247cbb677716",
              "status": "affected",
              "version": "e74c39573d35e9ac441090ff8183aa3dc2540649",
              "versionType": "git"
            },
            {
              "lessThan": "712a92a48158e02155b4b6b21e03a817f78c9b7e",
              "status": "affected",
              "version": "e74c39573d35e9ac441090ff8183aa3dc2540649",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/dw-edma/dw-hdma-v0-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.21",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup\n\nThe Linked list element and pointer are not stored in the same memory as\nthe HDMA controller register. If the doorbell register is toggled before\nthe full write of the linked list a race condition error will occur.\nIn remote setup we can only use a readl to the memory to assure the full\nwrite has occurred."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The affected code is a host-side dmaengine driver for a DesignWare HDMA engine resident in a remote PCIe endpoint; it is exercised by local I/O against the client device, with no network-facing protocol handler anywhere on the path.\nAC:L - The driver omits the required LL/doorbell ordering entirely rather than losing a rare timing window, so the commit states the race \"will occur\" during ordinary remote transfers; an attacker issuing repeated transfers (and loading the PCIe link to delay the posted MWr TLPs) triggers it reliably.\nPR:L - An unprivileged local user with access to the client device that moves data over the remote HDMA channel can drive the transfers that hit the race; no root or real capability is required.\nUI:N - The race is hit by the attacker\u0027s own device I/O; no victim action or separate user step is needed.\nS:U - The corruption occurs in host kernel memory under the same security authority as the driver; IOMMU/DMA translation boundaries are still applied to the transfer, so no boundary is crossed.\nC:H - A stale or half-updated `sar` in the reused LL region makes the engine read host memory belonging to a previously mapped, now-freed and reused buffer and copy it into the current destination, giving disclosure of arbitrary kernel/other-process memory contents.\nI:H - A stale or half-updated 64-bit `dar` makes the endpoint DMA-write into host physical memory that is no longer part of the transfer, an uncontrolled write primitive into kernel or other-process pages.\nA:H - Wild-address DMA and malformed descriptors cause DMA aborts, IOMMU faults and kernel memory corruption, resulting in oopses, panics and stalled DMA channels."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:39.981Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/227ef58a9b0c372efba422e8886a8015a1509eba"
        },
        {
          "url": "https://git.kernel.org/stable/c/17be6f5cb223f22e4733ed8fe8b2247cbb677716"
        },
        {
          "url": "https://git.kernel.org/stable/c/712a92a48158e02155b4b6b21e03a817f78c9b7e"
        }
      ],
      "title": "dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27409",
    "datePublished": "2024-05-17T11:50:39.756Z",
    "dateReserved": "2024-02-25T13:47:42.682Z",
    "dateUpdated": "2026-08-05T11:29:39.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27409",
      "date": "2026-08-19",
      "epss": "0.00245",
      "percentile": "0.16041"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup\\n\\nThe Linked list element and pointer are not stored in the same memory as\\nthe HDMA controller register. If the doorbell register is toggled before\\nthe full write of the linked list a race condition error will occur.\\nIn remote setup we can only use a readl to the memory to assure the full\\nwrite has occurred.\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: dmaengine: dw-edma: HDMA: A\\u00f1adida lectura sincronizada antes de iniciar la transferencia DMA en la configuraci\\u00f3n remota. El elemento de la lista vinculada y el puntero no se almacenan en la misma memoria que el registro del controlador HDMA. Si el registro del timbre se activa antes de la escritura completa de la lista vinculada, se producir\\u00e1 un error de condici\\u00f3n de ejecuci\\u00f3n. En la configuraci\\u00f3n remota, solo podemos usar una lectura en la memoria para asegurarnos de que se haya producido la escritura completa.\"}]",
      "id": "CVE-2024-27409",
      "lastModified": "2024-11-21T09:04:33.653",
      "published": "2024-05-17T12:15:11.460",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/17be6f5cb223f22e4733ed8fe8b2247cbb677716\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/227ef58a9b0c372efba422e8886a8015a1509eba\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/712a92a48158e02155b4b6b21e03a817f78c9b7e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/17be6f5cb223f22e4733ed8fe8b2247cbb677716\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/227ef58a9b0c372efba422e8886a8015a1509eba\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/712a92a48158e02155b4b6b21e03a817f78c9b7e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27409\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T12:15:11.460\",\"lastModified\":\"2026-08-04T11:17:47.397\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup\\n\\nThe Linked list element and pointer are not stored in the same memory as\\nthe HDMA controller register. If the doorbell register is toggled before\\nthe full write of the linked list a race condition error will occur.\\nIn remote setup we can only use a readl to the memory to assure the full\\nwrite has occurred.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: dmaengine: dw-edma: HDMA: A\u00f1adida lectura sincronizada antes de iniciar la transferencia DMA en la configuraci\u00f3n remota. El elemento de la lista vinculada y el puntero no se almacenan en la misma memoria que el registro del controlador HDMA. Si el registro del timbre se activa antes de la escritura completa de la lista vinculada, se producir\u00e1 un error de condici\u00f3n de ejecuci\u00f3n. En la configuraci\u00f3n remota, solo podemos usar una lectura en la memoria para asegurarnos de que se haya producido la escritura completa.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/dma/dw-edma/dw-hdma-v0-core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e74c39573d35e9ac441090ff8183aa3dc2540649\",\"lessThan\":\"227ef58a9b0c372efba422e8886a8015a1509eba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e74c39573d35e9ac441090ff8183aa3dc2540649\",\"lessThan\":\"17be6f5cb223f22e4733ed8fe8b2247cbb677716\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e74c39573d35e9ac441090ff8183aa3dc2540649\",\"lessThan\":\"712a92a48158e02155b4b6b21e03a817f78c9b7e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/dma/dw-edma/dw-hdma-v0-core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.21\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.9\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-20T17:32:55.652133Z\",\"id\":\"CVE-2024-27409\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.21\",\"matchCriteriaId\":\"BC0DAF43-2BA8-4BDC-84DA-C9482F59F45B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.9\",\"matchCriteriaId\":\"1C538467-EDA0-4A9A-82EB-2925DE9FF827\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/17be6f5cb223f22e4733ed8fe8b2247cbb677716\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/227ef58a9b0c372efba422e8886a8015a1509eba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/712a92a48158e02155b4b6b21e03a817f78c9b7e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/17be6f5cb223f22e4733ed8fe8b2247cbb677716\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/227ef58a9b0c372efba422e8886a8015a1509eba\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/712a92a48158e02155b4b6b21e03a817f78c9b7e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T17:06:51+00:00",
      "cve": "CVE-2024-27409",
      "id": "CVE-2024-27409",
      "initial_release_date": "2024-05-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27409.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:52:56Z",
      "cve": "CVE-2024-27409",
      "id": "CVE-2024-27409",
      "initial_release_date": "2024-05-18T02:46:12Z",
      "product_status:known_not_affected": "330",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-27409",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-27409.json",
      "version": "18"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/227ef58a9b0c372efba422e8886a8015a1509eba\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/17be6f5cb223f22e4733ed8fe8b2247cbb677716\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/712a92a48158e02155b4b6b21e03a817f78c9b7e\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:34:52.290Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27409\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-20T17:32:55.652133Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.079Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The affected code is a host-side dmaengine driver for a DesignWare HDMA engine resident in a remote PCIe endpoint; it is exercised by local I/O against the client device, with no network-facing protocol handler anywhere on the path.\\nAC:L - The driver omits the required LL/doorbell ordering entirely rather than losing a rare timing window, so the commit states the race \\\"will occur\\\" during ordinary remote transfers; an attacker issuing repeated transfers (and loading the PCIe link to delay the posted MWr TLPs) triggers it reliably.\\nPR:L - An unprivileged local user with access to the client device that moves data over the remote HDMA channel can drive the transfers that hit the race; no root or real capability is required.\\nUI:N - The race is hit by the attacker\u0027s own device I/O; no victim action or separate user step is needed.\\nS:U - The corruption occurs in host kernel memory under the same security authority as the driver; IOMMU/DMA translation boundaries are still applied to the transfer, so no boundary is crossed.\\nC:H - A stale or half-updated `sar` in the reused LL region makes the engine read host memory belonging to a previously mapped, now-freed and reused buffer and copy it into the current destination, giving disclosure of arbitrary kernel/other-process memory contents.\\nI:H - A stale or half-updated 64-bit `dar` makes the endpoint DMA-write into host physical memory that is no longer part of the transfer, an uncontrolled write primitive into kernel or other-process pages.\\nA:H - Wild-address DMA and malformed descriptors cause DMA aborts, IOMMU faults and kernel memory corruption, resulting in oopses, panics and stalled DMA channels.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e74c39573d35e9ac441090ff8183aa3dc2540649\", \"lessThan\": \"227ef58a9b0c372efba422e8886a8015a1509eba\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e74c39573d35e9ac441090ff8183aa3dc2540649\", \"lessThan\": \"17be6f5cb223f22e4733ed8fe8b2247cbb677716\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e74c39573d35e9ac441090ff8183aa3dc2540649\", \"lessThan\": \"712a92a48158e02155b4b6b21e03a817f78c9b7e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/dma/dw-edma/dw-hdma-v0-core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.21\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/dma/dw-edma/dw-hdma-v0-core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/227ef58a9b0c372efba422e8886a8015a1509eba\"}, {\"url\": \"https://git.kernel.org/stable/c/17be6f5cb223f22e4733ed8fe8b2247cbb677716\"}, {\"url\": \"https://git.kernel.org/stable/c/712a92a48158e02155b4b6b21e03a817f78c9b7e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup\\n\\nThe Linked list element and pointer are not stored in the same memory as\\nthe HDMA controller register. If the doorbell register is toggled before\\nthe full write of the linked list a race condition error will occur.\\nIn remote setup we can only use a readl to the memory to assure the full\\nwrite has occurred.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.21\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.9\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:29:39.981Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27409\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:29:39.981Z\", \"dateReserved\": \"2024-02-25T13:47:42.682Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T11:50:39.756Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.