CVE-2024-35814 (GCVE-0-2024-35814)

Vulnerability from cvelistv5 – Published: 2024-05-17 13:23 – Updated: 2026-08-05 11:30
VLAI
Title
swiotlb: Fix double-allocation of slots due to broken alignment handling
Summary
In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fix double-allocation of slots due to broken alignment handling Commit bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix"), which was a fix for commit 0eee5ae10256 ("swiotlb: fix slot alignment checks"), causes a functional regression with vsock in a virtual machine using bouncing via a restricted DMA SWIOTLB pool. When virtio allocates the virtqueues for the vsock device using dma_alloc_coherent(), the SWIOTLB search can return page-unaligned allocations if 'area->index' was left unaligned by a previous allocation from the buffer: # Final address in brackets is the SWIOTLB address returned to the caller | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800) This ends badly (typically buffer corruption and/or a hang) because swiotlb_alloc() is expecting a page-aligned allocation and so blindly returns a pointer to the 'struct page' corresponding to the allocation, therefore double-allocating the first half (2KiB slot) of the 4KiB page. Fix the problem by treating the allocation alignment separately to any additional alignment requirements from the device, using the maximum of the two as the stride to search the buffer slots and taking care to ensure a minimum of page-alignment for buffers larger than a page. This also resolves swiotlb allocation failures occuring due to the inclusion of ~PAGE_MASK in 'iotlb_align_mask' for large allocations and resulting in alignment requirements exceeding swiotlb_max_mapping_size().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-1055 - Multiple Inheritance from Concrete Classes
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0eee5ae1025699ea93d44fdb6ef2365505082103 , < 3e7acd6e25ba77dde48c3b721c54c89cd6a10534 (git)
Affected: 0eee5ae1025699ea93d44fdb6ef2365505082103 , < c88668aa6c1da240ea3eb4d128b7906e740d3cb8 (git)
Affected: 0eee5ae1025699ea93d44fdb6ef2365505082103 , < 777391743771040e12cc40d3d0d178f70c616491 (git)
Affected: 0eee5ae1025699ea93d44fdb6ef2365505082103 , < 04867a7a33324c9c562ee7949dbcaab7aaad1fb4 (git)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.24 , ≤ 6.6.* (semver)
Unaffected: 6.7.12 , ≤ 6.7.* (semver)
Unaffected: 6.8.3 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
linux linux_kernel Affected: 0eee5ae10256 , < 3e7acd6e25ba (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Affected: 0eee5ae10256 , < c88668aa6c1d (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Affected: 0eee5ae10256 , < 777391743771 (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Affected: 0eee5ae10256 , < 04867a7a3332 (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Affected: 6.3
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Unaffected: 0 , < 6.3 (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Unaffected: 6.6.24 , < 6.6.* (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Unaffected: 6.7.12 , ≤ 6.7.* (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Unaffected: 6.8.3 , ≤ 6.8.* (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Unaffected: 6.9
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "3e7acd6e25ba",
                "status": "affected",
                "version": "0eee5ae10256",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "c88668aa6c1d",
                "status": "affected",
                "version": "0eee5ae10256",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "777391743771",
                "status": "affected",
                "version": "0eee5ae10256",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "04867a7a3332",
                "status": "affected",
                "version": "0eee5ae10256",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.3"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "6.3",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "6.6.*",
                "status": "unaffected",
                "version": "6.6.24",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.7.*",
                "status": "unaffected",
                "version": "6.7.12",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.8.*",
                "status": "unaffected",
                "version": "6.8.3",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "6.9"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35814",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T20:30:30.911861Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-1055",
                "description": "CWE-1055 Multiple Inheritance from Concrete Classes",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-05T20:30:38.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.615Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3e7acd6e25ba77dde48c3b721c54c89cd6a10534"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c88668aa6c1da240ea3eb4d128b7906e740d3cb8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/777391743771040e12cc40d3d0d178f70c616491"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/04867a7a33324c9c562ee7949dbcaab7aaad1fb4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/dma/swiotlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3e7acd6e25ba77dde48c3b721c54c89cd6a10534",
              "status": "affected",
              "version": "0eee5ae1025699ea93d44fdb6ef2365505082103",
              "versionType": "git"
            },
            {
              "lessThan": "c88668aa6c1da240ea3eb4d128b7906e740d3cb8",
              "status": "affected",
              "version": "0eee5ae1025699ea93d44fdb6ef2365505082103",
              "versionType": "git"
            },
            {
              "lessThan": "777391743771040e12cc40d3d0d178f70c616491",
              "status": "affected",
              "version": "0eee5ae1025699ea93d44fdb6ef2365505082103",
              "versionType": "git"
            },
            {
              "lessThan": "04867a7a33324c9c562ee7949dbcaab7aaad1fb4",
              "status": "affected",
              "version": "0eee5ae1025699ea93d44fdb6ef2365505082103",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/dma/swiotlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nswiotlb: Fix double-allocation of slots due to broken alignment handling\n\nCommit bbb73a103fbb (\"swiotlb: fix a braino in the alignment check fix\"),\nwhich was a fix for commit 0eee5ae10256 (\"swiotlb: fix slot alignment\nchecks\"), causes a functional regression with vsock in a virtual machine\nusing bouncing via a restricted DMA SWIOTLB pool.\n\nWhen virtio allocates the virtqueues for the vsock device using\ndma_alloc_coherent(), the SWIOTLB search can return page-unaligned\nallocations if \u0027area-\u003eindex\u0027 was left unaligned by a previous allocation\nfrom the buffer:\n\n # Final address in brackets is the SWIOTLB address returned to the caller\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800)\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800)\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800)\n\nThis ends badly (typically buffer corruption and/or a hang) because\nswiotlb_alloc() is expecting a page-aligned allocation and so blindly\nreturns a pointer to the \u0027struct page\u0027 corresponding to the allocation,\ntherefore double-allocating the first half (2KiB slot) of the 4KiB page.\n\nFix the problem by treating the allocation alignment separately to any\nadditional alignment requirements from the device, using the maximum\nof the two as the stride to search the buffer slots and taking care\nto ensure a minimum of page-alignment for buffers larger than a page.\n\nThis also resolves swiotlb allocation failures occuring due to the\ninclusion of ~PAGE_MASK in \u0027iotlb_align_mask\u0027 for large allocations and\nresulting in alignment requirements exceeding swiotlb_max_mapping_size()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is in the core DMA bounce-buffer allocator (`kernel/dma/swiotlb.c`) and is driven by local DMA activity \u2014 `dma_alloc_coherent()`/`dma_map_page()` issued on behalf of a local process doing device or block/network I/O. There is no network-facing protocol handler parsing remote data on the path to `swiotlb_search_pool_area()`.\nAC:L - Triggering is deterministic and race-free: the attacker only needs `area-\u003eindex` left at an odd slot by any prior odd-sized bounce (routine for ordinary I/O) so the stride-2 search returns page-unaligned slots, and for the mapping path merely a buffer whose page offset is \u003e= 2048. Both the restricted-DMA-pool `swiotlb_alloc()` path and the generic `iommu_dma_map_page()`/untrusted-device and arm64 kmalloc-bounce paths are affected, so this is not confined to a rare config.\nPR:L - No capability, admin right, or `CAP_SYS_*` check exists anywhere between userspace and `swiotlb_find_slots()`; any unprivileged process can consume and release swiotlb slots and force coherent DMA allocations through normal file, socket, and device-node I/O. Local access is required, so basic user privileges rather than none.\nUI:N - The attacking process performs the entire allocate/free/map sequence itself. No victim action such as mounting a filesystem, opening a file, or plugging in hardware is required.\nS:U - The corrupted and over-exposed memory is host kernel memory \u2014 swiotlb slots and DMA-coherent buffers \u2014 managed by the same kernel security authority as the vulnerable allocator. Even the granule-misaligned IOMMU mapping stays inside the swiotlb region, so no VM, hypervisor, or sandbox boundary is crossed.\nC:H - `swiotlb_alloc()` returns `pfn_to_page(PFN_DOWN(tlb_addr))` for an unaligned slot, so a caller receives a page whose first 2 KiB is another live allocation\u0027s DMA data, and the mis-rounded `swiotlb_free()` recycles in-use slots so in-flight device DMA lands in memory handed to a different owner. On the `iommu_dma_map_page()` path `__iommu_dma_map()` maps `phys - iova_off`, granting a device \u2014 including an untrusted external PCIe/Thunderbolt device \u2014 DMA read visibility into an adjacent bounce buffer holding unrelated in-flight I/O.\nI:H - Two independent `dma_alloc_coherent()` consumers end up writing the same physical page, so device DMA and driver writes clobber the other allocation\u0027s contents \u2014 including virtio virtqueue descriptor tables holding physical addresses and lengths, which is a controllable kernel memory corruption primitive. The same misaligned IOMMU window is mapped writable for `DMA_FROM_DEVICE`/`DMA_BIDIRECTIONAL`, letting a device write outside its intended buffer.\nA:H - The commit message states the double-allocation \"ends badly (typically buffer corruption and/or a hang)\", and corrupted virtqueue rings or DMA descriptors readily produce oops/panic. Additionally, the bogus `~PAGE_MASK` alignment requirement exceeds `swiotlb_max_mapping_size()` and causes persistent \"swiotlb buffer is full\" mapping failures, breaking device I/O."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:08.016Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3e7acd6e25ba77dde48c3b721c54c89cd6a10534"
        },
        {
          "url": "https://git.kernel.org/stable/c/c88668aa6c1da240ea3eb4d128b7906e740d3cb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/777391743771040e12cc40d3d0d178f70c616491"
        },
        {
          "url": "https://git.kernel.org/stable/c/04867a7a33324c9c562ee7949dbcaab7aaad1fb4"
        }
      ],
      "title": "swiotlb: Fix double-allocation of slots due to broken alignment handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35814",
    "datePublished": "2024-05-17T13:23:19.590Z",
    "dateReserved": "2024-05-17T12:19:12.343Z",
    "dateUpdated": "2026-08-05T11:30:08.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35814",
      "date": "2026-08-05",
      "epss": "0.00234",
      "percentile": "0.1434"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nswiotlb: Fix double-allocation of slots due to broken alignment handling\\n\\nCommit bbb73a103fbb (\\\"swiotlb: fix a braino in the alignment check fix\\\"),\\nwhich was a fix for commit 0eee5ae10256 (\\\"swiotlb: fix slot alignment\\nchecks\\\"), causes a functional regression with vsock in a virtual machine\\nusing bouncing via a restricted DMA SWIOTLB pool.\\n\\nWhen virtio allocates the virtqueues for the vsock device using\\ndma_alloc_coherent(), the SWIOTLB search can return page-unaligned\\nallocations if \u0027area-\u003eindex\u0027 was left unaligned by a previous allocation\\nfrom the buffer:\\n\\n # Final address in brackets is the SWIOTLB address returned to the caller\\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800)\\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800)\\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800)\\n\\nThis ends badly (typically buffer corruption and/or a hang) because\\nswiotlb_alloc() is expecting a page-aligned allocation and so blindly\\nreturns a pointer to the \u0027struct page\u0027 corresponding to the allocation,\\ntherefore double-allocating the first half (2KiB slot) of the 4KiB page.\\n\\nFix the problem by treating the allocation alignment separately to any\\nadditional alignment requirements from the device, using the maximum\\nof the two as the stride to search the buffer slots and taking care\\nto ensure a minimum of page-alignment for buffers larger than a page.\\n\\nThis also resolves swiotlb allocation failures occuring due to the\\ninclusion of ~PAGE_MASK in \u0027iotlb_align_mask\u0027 for large allocations and\\nresulting in alignment requirements exceeding swiotlb_max_mapping_size().\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: swiotlb: corregida la doble asignaci\\u00f3n de ranuras debido a un manejo de alineaci\\u00f3n roto. Confirmaci\\u00f3n bbb73a103fbb (\\\"swiotlb: corrija un barino en la correcci\\u00f3n de verificaci\\u00f3n de alineaci\\u00f3n\\\"), que fue una soluci\\u00f3n para la confirmaci\\u00f3n 0eee5ae10256 ( \\\"swiotlb: corregir comprobaciones de alineaci\\u00f3n de ranuras\\\"), provoca una regresi\\u00f3n funcional con vsock en una m\\u00e1quina virtual mediante el rebote a trav\\u00e9s de un grupo DMA SWIOTLB restringido. Cuando virtio asigna las colas virtio para el dispositivo vsock usando dma_alloc_coherent(), la b\\u00fasqueda de SWIOTLB puede devolver asignaciones de p\\u00e1gina no alineadas si \u0027area-\u0026gt;index\u0027 qued\\u00f3 desalineado por una asignaci\\u00f3n anterior del b\\u00fafer: # La direcci\\u00f3n final entre par\\u00e9ntesis es la direcci\\u00f3n de SWIOTLB devuelto a la persona que llama | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: obtuvo la ranura 1645-1649/7168 (0x98326800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: obtuvo la ranura 1649-1653/7168 (0x98328800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: obtuvo la ranura 1653-1657/7168 (0x9832a800) Esto termina mal (normalmente corrupci\\u00f3n del b\\u00fafer y/o bloqueo) porque swiotlb_alloc() est\\u00e1 esperando una p\\u00e1gina -asignaci\\u00f3n alineada y, por lo tanto, devuelve ciegamente un puntero a la \u0027struct page\u0027 correspondiente a la asignaci\\u00f3n, por lo que asigna dos veces la primera mitad (ranura de 2 KB) de la p\\u00e1gina de 4 KB. Solucione el problema tratando la alineaci\\u00f3n de asignaci\\u00f3n por separado de cualquier requisito de alineaci\\u00f3n adicional del dispositivo, utilizando el m\\u00e1ximo de los dos como paso para buscar las ranuras del b\\u00fafer y teniendo cuidado de garantizar un m\\u00ednimo de alineaci\\u00f3n de p\\u00e1gina para b\\u00faferes m\\u00e1s grandes que una p\\u00e1gina. Esto tambi\\u00e9n resuelve las fallos de asignaci\\u00f3n de swiotlb que ocurren debido a la inclusi\\u00f3n de ~PAGE_MASK en \u0027iotlb_align_mask\u0027 para asignaciones grandes y que resultan en requisitos de alineaci\\u00f3n que exceden swiotlb_max_mapping_size().\"}]",
      "id": "CVE-2024-35814",
      "lastModified": "2024-11-21T09:20:57.387",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.2}]}",
      "published": "2024-05-17T14:15:15.853",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/04867a7a33324c9c562ee7949dbcaab7aaad1fb4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3e7acd6e25ba77dde48c3b721c54c89cd6a10534\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/777391743771040e12cc40d3d0d178f70c616491\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c88668aa6c1da240ea3eb4d128b7906e740d3cb8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/04867a7a33324c9c562ee7949dbcaab7aaad1fb4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/3e7acd6e25ba77dde48c3b721c54c89cd6a10534\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/777391743771040e12cc40d3d0d178f70c616491\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c88668aa6c1da240ea3eb4d128b7906e740d3cb8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-119\"}, {\"lang\": \"en\", \"value\": \"CWE-1055\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35814\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T14:15:15.853\",\"lastModified\":\"2026-08-04T11:17:55.957\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nswiotlb: Fix double-allocation of slots due to broken alignment handling\\n\\nCommit bbb73a103fbb (\\\"swiotlb: fix a braino in the alignment check fix\\\"),\\nwhich was a fix for commit 0eee5ae10256 (\\\"swiotlb: fix slot alignment\\nchecks\\\"), causes a functional regression with vsock in a virtual machine\\nusing bouncing via a restricted DMA SWIOTLB pool.\\n\\nWhen virtio allocates the virtqueues for the vsock device using\\ndma_alloc_coherent(), the SWIOTLB search can return page-unaligned\\nallocations if \u0027area-\u003eindex\u0027 was left unaligned by a previous allocation\\nfrom the buffer:\\n\\n # Final address in brackets is the SWIOTLB address returned to the caller\\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800)\\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800)\\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800)\\n\\nThis ends badly (typically buffer corruption and/or a hang) because\\nswiotlb_alloc() is expecting a page-aligned allocation and so blindly\\nreturns a pointer to the \u0027struct page\u0027 corresponding to the allocation,\\ntherefore double-allocating the first half (2KiB slot) of the 4KiB page.\\n\\nFix the problem by treating the allocation alignment separately to any\\nadditional alignment requirements from the device, using the maximum\\nof the two as the stride to search the buffer slots and taking care\\nto ensure a minimum of page-alignment for buffers larger than a page.\\n\\nThis also resolves swiotlb allocation failures occuring due to the\\ninclusion of ~PAGE_MASK in \u0027iotlb_align_mask\u0027 for large allocations and\\nresulting in alignment requirements exceeding swiotlb_max_mapping_size().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: swiotlb: corregida la doble asignaci\u00f3n de ranuras debido a un manejo de alineaci\u00f3n roto. Confirmaci\u00f3n bbb73a103fbb (\\\"swiotlb: corrija un barino en la correcci\u00f3n de verificaci\u00f3n de alineaci\u00f3n\\\"), que fue una soluci\u00f3n para la confirmaci\u00f3n 0eee5ae10256 ( \\\"swiotlb: corregir comprobaciones de alineaci\u00f3n de ranuras\\\"), provoca una regresi\u00f3n funcional con vsock en una m\u00e1quina virtual mediante el rebote a trav\u00e9s de un grupo DMA SWIOTLB restringido. Cuando virtio asigna las colas virtio para el dispositivo vsock usando dma_alloc_coherent(), la b\u00fasqueda de SWIOTLB puede devolver asignaciones de p\u00e1gina no alineadas si \u0027area-\u0026gt;index\u0027 qued\u00f3 desalineado por una asignaci\u00f3n anterior del b\u00fafer: # La direcci\u00f3n final entre par\u00e9ntesis es la direcci\u00f3n de SWIOTLB devuelto a la persona que llama | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: obtuvo la ranura 1645-1649/7168 (0x98326800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: obtuvo la ranura 1649-1653/7168 (0x98328800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: obtuvo la ranura 1653-1657/7168 (0x9832a800) Esto termina mal (normalmente corrupci\u00f3n del b\u00fafer y/o bloqueo) porque swiotlb_alloc() est\u00e1 esperando una p\u00e1gina -asignaci\u00f3n alineada y, por lo tanto, devuelve ciegamente un puntero a la \u0027struct page\u0027 correspondiente a la asignaci\u00f3n, por lo que asigna dos veces la primera mitad (ranura de 2 KB) de la p\u00e1gina de 4 KB. Solucione el problema tratando la alineaci\u00f3n de asignaci\u00f3n por separado de cualquier requisito de alineaci\u00f3n adicional del dispositivo, utilizando el m\u00e1ximo de los dos como paso para buscar las ranuras del b\u00fafer y teniendo cuidado de garantizar un m\u00ednimo de alineaci\u00f3n de p\u00e1gina para b\u00faferes m\u00e1s grandes que una p\u00e1gina. Esto tambi\u00e9n resuelve las fallos de asignaci\u00f3n de swiotlb que ocurren debido a la inclusi\u00f3n de ~PAGE_MASK en \u0027iotlb_align_mask\u0027 para asignaciones grandes y que resultan en requisitos de alineaci\u00f3n que exceden swiotlb_max_mapping_size().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/dma/swiotlb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0eee5ae1025699ea93d44fdb6ef2365505082103\",\"lessThan\":\"3e7acd6e25ba77dde48c3b721c54c89cd6a10534\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0eee5ae1025699ea93d44fdb6ef2365505082103\",\"lessThan\":\"c88668aa6c1da240ea3eb4d128b7906e740d3cb8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0eee5ae1025699ea93d44fdb6ef2365505082103\",\"lessThan\":\"777391743771040e12cc40d3d0d178f70c616491\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0eee5ae1025699ea93d44fdb6ef2365505082103\",\"lessThan\":\"04867a7a33324c9c562ee7949dbcaab7aaad1fb4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/dma/swiotlb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.24\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.12\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.3\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0eee5ae10256\",\"lessThan\":\"3e7acd6e25ba\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0eee5ae10256\",\"lessThan\":\"c88668aa6c1d\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0eee5ae10256\",\"lessThan\":\"777391743771\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0eee5ae10256\",\"lessThan\":\"04867a7a3332\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"6.6.24\",\"lessThan\":\"6.6.*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"6.7.12\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"6.8.3\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"6.9\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-05T20:30:30.911861Z\",\"id\":\"CVE-2024-35814\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"},{\"lang\":\"en\",\"value\":\"CWE-1055\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.24\",\"matchCriteriaId\":\"8CF9EBD7-10AE-400D-BB67-06C2F3EBA390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.12\",\"matchCriteriaId\":\"6BE9771A-BAFD-4624-95F9-58D536540C53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.3\",\"matchCriteriaId\":\"4C59BBC3-6495-4A77-9C82-55EC7CDF5E02\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04867a7a33324c9c562ee7949dbcaab7aaad1fb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3e7acd6e25ba77dde48c3b721c54c89cd6a10534\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/777391743771040e12cc40d3d0d178f70c616491\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c88668aa6c1da240ea3eb4d128b7906e740d3cb8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/04867a7a33324c9c562ee7949dbcaab7aaad1fb4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3e7acd6e25ba77dde48c3b721c54c89cd6a10534\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/777391743771040e12cc40d3d0d178f70c616491\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c88668aa6c1da240ea3eb4d128b7906e740d3cb8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:48:20+00:00",
      "cve": "CVE-2024-35814",
      "id": "CVE-2024-35814",
      "initial_release_date": "2024-05-17T00:00:00+00:00",
      "product_status:fixed": "709",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "50",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: swiotlb: Fix double-allocation of slots due to broken alignment handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35814.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T02:06:58Z",
      "cve": "CVE-2024-35814",
      "id": "CVE-2024-35814",
      "initial_release_date": "2024-05-21T02:00:10Z",
      "product_status:known_affected": "330",
      "product_status:known_not_affected": "181",
      "product_status:recommended": "676",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35814",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35814.json",
      "version": "110"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3e7acd6e25ba77dde48c3b721c54c89cd6a10534\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c88668aa6c1da240ea3eb4d128b7906e740d3cb8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/777391743771040e12cc40d3d0d178f70c616491\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/04867a7a33324c9c562ee7949dbcaab7aaad1fb4\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:47.615Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35814\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-05T20:30:30.911861Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"0eee5ae10256\", \"lessThan\": \"3e7acd6e25ba\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"0eee5ae10256\", \"lessThan\": \"c88668aa6c1d\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"0eee5ae10256\", \"lessThan\": \"777391743771\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"0eee5ae10256\", \"lessThan\": \"04867a7a3332\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.6.24\", \"lessThan\": \"6.6.*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.7.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.7.*\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.8.3\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.8.*\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.9\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-119\", \"description\": \"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1055\", \"description\": \"CWE-1055 Multiple Inheritance from Concrete Classes\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-05T20:21:27.934Z\"}}], \"cna\": {\"title\": \"swiotlb: Fix double-allocation of slots due to broken alignment handling\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The defect is in the core DMA bounce-buffer allocator (`kernel/dma/swiotlb.c`) and is driven by local DMA activity \\u2014 `dma_alloc_coherent()`/`dma_map_page()` issued on behalf of a local process doing device or block/network I/O. There is no network-facing protocol handler parsing remote data on the path to `swiotlb_search_pool_area()`.\\nAC:L - Triggering is deterministic and race-free: the attacker only needs `area-\u003eindex` left at an odd slot by any prior odd-sized bounce (routine for ordinary I/O) so the stride-2 search returns page-unaligned slots, and for the mapping path merely a buffer whose page offset is \u003e= 2048. Both the restricted-DMA-pool `swiotlb_alloc()` path and the generic `iommu_dma_map_page()`/untrusted-device and arm64 kmalloc-bounce paths are affected, so this is not confined to a rare config.\\nPR:L - No capability, admin right, or `CAP_SYS_*` check exists anywhere between userspace and `swiotlb_find_slots()`; any unprivileged process can consume and release swiotlb slots and force coherent DMA allocations through normal file, socket, and device-node I/O. Local access is required, so basic user privileges rather than none.\\nUI:N - The attacking process performs the entire allocate/free/map sequence itself. No victim action such as mounting a filesystem, opening a file, or plugging in hardware is required.\\nS:U - The corrupted and over-exposed memory is host kernel memory \\u2014 swiotlb slots and DMA-coherent buffers \\u2014 managed by the same kernel security authority as the vulnerable allocator. Even the granule-misaligned IOMMU mapping stays inside the swiotlb region, so no VM, hypervisor, or sandbox boundary is crossed.\\nC:H - `swiotlb_alloc()` returns `pfn_to_page(PFN_DOWN(tlb_addr))` for an unaligned slot, so a caller receives a page whose first 2 KiB is another live allocation\u0027s DMA data, and the mis-rounded `swiotlb_free()` recycles in-use slots so in-flight device DMA lands in memory handed to a different owner. On the `iommu_dma_map_page()` path `__iommu_dma_map()` maps `phys - iova_off`, granting a device \\u2014 including an untrusted external PCIe/Thunderbolt device \\u2014 DMA read visibility into an adjacent bounce buffer holding unrelated in-flight I/O.\\nI:H - Two independent `dma_alloc_coherent()` consumers end up writing the same physical page, so device DMA and driver writes clobber the other allocation\u0027s contents \\u2014 including virtio virtqueue descriptor tables holding physical addresses and lengths, which is a controllable kernel memory corruption primitive. The same misaligned IOMMU window is mapped writable for `DMA_FROM_DEVICE`/`DMA_BIDIRECTIONAL`, letting a device write outside its intended buffer.\\nA:H - The commit message states the double-allocation \\\"ends badly (typically buffer corruption and/or a hang)\\\", and corrupted virtqueue rings or DMA descriptors readily produce oops/panic. Additionally, the bogus `~PAGE_MASK` alignment requirement exceeds `swiotlb_max_mapping_size()` and causes persistent \\\"swiotlb buffer is full\\\" mapping failures, breaking device I/O.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0eee5ae1025699ea93d44fdb6ef2365505082103\", \"lessThan\": \"3e7acd6e25ba77dde48c3b721c54c89cd6a10534\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0eee5ae1025699ea93d44fdb6ef2365505082103\", \"lessThan\": \"c88668aa6c1da240ea3eb4d128b7906e740d3cb8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0eee5ae1025699ea93d44fdb6ef2365505082103\", \"lessThan\": \"777391743771040e12cc40d3d0d178f70c616491\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0eee5ae1025699ea93d44fdb6ef2365505082103\", \"lessThan\": \"04867a7a33324c9c562ee7949dbcaab7aaad1fb4\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/dma/swiotlb.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/dma/swiotlb.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3e7acd6e25ba77dde48c3b721c54c89cd6a10534\"}, {\"url\": \"https://git.kernel.org/stable/c/c88668aa6c1da240ea3eb4d128b7906e740d3cb8\"}, {\"url\": \"https://git.kernel.org/stable/c/777391743771040e12cc40d3d0d178f70c616491\"}, {\"url\": \"https://git.kernel.org/stable/c/04867a7a33324c9c562ee7949dbcaab7aaad1fb4\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nswiotlb: Fix double-allocation of slots due to broken alignment handling\\n\\nCommit bbb73a103fbb (\\\"swiotlb: fix a braino in the alignment check fix\\\"),\\nwhich was a fix for commit 0eee5ae10256 (\\\"swiotlb: fix slot alignment\\nchecks\\\"), causes a functional regression with vsock in a virtual machine\\nusing bouncing via a restricted DMA SWIOTLB pool.\\n\\nWhen virtio allocates the virtqueues for the vsock device using\\ndma_alloc_coherent(), the SWIOTLB search can return page-unaligned\\nallocations if \u0027area-\u003eindex\u0027 was left unaligned by a previous allocation\\nfrom the buffer:\\n\\n # Final address in brackets is the SWIOTLB address returned to the caller\\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800)\\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800)\\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800)\\n\\nThis ends badly (typically buffer corruption and/or a hang) because\\nswiotlb_alloc() is expecting a page-aligned allocation and so blindly\\nreturns a pointer to the \u0027struct page\u0027 corresponding to the allocation,\\ntherefore double-allocating the first half (2KiB slot) of the 4KiB page.\\n\\nFix the problem by treating the allocation alignment separately to any\\nadditional alignment requirements from the device, using the maximum\\nof the two as the stride to search the buffer slots and taking care\\nto ensure a minimum of page-alignment for buffers larger than a page.\\n\\nThis also resolves swiotlb allocation failures occuring due to the\\ninclusion of ~PAGE_MASK in \u0027iotlb_align_mask\u0027 for large allocations and\\nresulting in alignment requirements exceeding swiotlb_max_mapping_size().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.24\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.12\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.3\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:08.016Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35814\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:08.016Z\", \"dateReserved\": \"2024-05-17T12:19:12.343Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T13:23:19.590Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.