GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-36884 (GCVE-0-2024-36884)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:28 – Updated: 2026-08-05 11:31
VLAI
Title
iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault() This was missed because of the function pointer indirection. nvidia_smmu_context_fault() is also installed as a irq function, and the 'void *' was changed to a struct arm_smmu_domain. Since the iommu_domain is embedded at a non-zero offset this causes nvidia_smmu_context_fault() to miscompute the offset. Fixup the types. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000120 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107c9f000 [0000000000000120] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 1 PID: 47 Comm: kworker/u25:0 Not tainted 6.9.0-0.rc7.58.eln136.aarch64 #1 Hardware name: Unknown NVIDIA Jetson Orin NX/NVIDIA Jetson Orin NX, BIOS 3.1-32827747 03/19/2023 Workqueue: events_unbound deferred_probe_work_func pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : nvidia_smmu_context_fault+0x1c/0x158 lr : __free_irq+0x1d4/0x2e8 sp : ffff80008044b6f0 x29: ffff80008044b6f0 x28: ffff000080a60b18 x27: ffffd32b5172e970 x26: 0000000000000000 x25: ffff0000802f5aac x24: ffff0000802f5a30 x23: ffff0000802f5b60 x22: 0000000000000057 x21: 0000000000000000 x20: ffff0000802f5a00 x19: ffff000087d4cd80 x18: ffffffffffffffff x17: 6234362066666666 x16: 6630303078302d30 x15: ffff00008156d888 x14: 0000000000000000 x13: ffff0000801db910 x12: ffff00008156d6d0 x11: 0000000000000003 x10: ffff0000801db918 x9 : ffffd32b50f94d9c x8 : 1fffe0001032fda1 x7 : ffff00008197ed00 x6 : 000000000000000f x5 : 000000000000010e x4 : 000000000000010e x3 : 0000000000000000 x2 : ffffd32b51720cd8 x1 : ffff000087e6f700 x0 : 0000000000000057 Call trace: nvidia_smmu_context_fault+0x1c/0x158 __free_irq+0x1d4/0x2e8 free_irq+0x3c/0x80 devm_free_irq+0x64/0xa8 arm_smmu_domain_free+0xc4/0x158 iommu_domain_free+0x44/0xa0 iommu_deinit_device+0xd0/0xf8 __iommu_group_remove_device+0xcc/0xe0 iommu_bus_notifier+0x64/0xa8 notifier_call_chain+0x78/0x148 blocking_notifier_call_chain+0x4c/0x90 bus_notify+0x44/0x70 device_del+0x264/0x3e8 pci_remove_bus_device+0x84/0x120 pci_remove_root_bus+0x5c/0xc0 dw_pcie_host_deinit+0x38/0xe0 tegra_pcie_config_rp+0xc0/0x1f0 tegra_pcie_dw_probe+0x34c/0x700 platform_probe+0x70/0xe8 really_probe+0xc8/0x3a0 __driver_probe_device+0x84/0x160 driver_probe_device+0x44/0x130 __device_attach_driver+0xc4/0x170 bus_for_each_drv+0x90/0x100 __device_attach+0xa8/0x1c8 device_initial_probe+0x1c/0x30 bus_probe_device+0xb0/0xc0 deferred_probe_work_func+0xbc/0x120 process_one_work+0x194/0x490 worker_thread+0x284/0x3b0 kthread+0xf4/0x108 ret_from_fork+0x10/0x20 Code: a9b97bfd 910003fd a9025bf5 f85a0035 (b94122a1)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-17 17:32 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e0976331ad114af8e379e18483c346c6c79ca858 , < e83de8f05b998e227b48cdeea54cba4c9d66d3aa (git)
Affected: e0976331ad114af8e379e18483c346c6c79ca858 , < 65ade5653f5ab5a21635e51d0c65e95f490f5b6f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36884",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:32:53.413212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:33:10.028Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:49.220Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e83de8f05b998e227b48cdeea54cba4c9d66d3aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/65ade5653f5ab5a21635e51d0c65e95f490f5b6f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e83de8f05b998e227b48cdeea54cba4c9d66d3aa",
              "status": "affected",
              "version": "e0976331ad114af8e379e18483c346c6c79ca858",
              "versionType": "git"
            },
            {
              "lessThan": "65ade5653f5ab5a21635e51d0c65e95f490f5b6f",
              "status": "affected",
              "version": "e0976331ad114af8e379e18483c346c6c79ca858",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()\n\nThis was missed because of the function pointer indirection.\n\nnvidia_smmu_context_fault() is also installed as a irq function, and the\n\u0027void *\u0027 was changed to a struct arm_smmu_domain. Since the iommu_domain\nis embedded at a non-zero offset this causes nvidia_smmu_context_fault()\nto miscompute the offset. Fixup the types.\n\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000120\n  Mem abort info:\n    ESR = 0x0000000096000004\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n    FSC = 0x04: level 0 translation fault\n  Data abort info:\n    ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n    CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n  user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107c9f000\n  [0000000000000120] pgd=0000000000000000, p4d=0000000000000000\n  Internal error: Oops: 0000000096000004 [#1] SMP\n  Modules linked in:\n  CPU: 1 PID: 47 Comm: kworker/u25:0 Not tainted 6.9.0-0.rc7.58.eln136.aarch64 #1\n  Hardware name: Unknown NVIDIA Jetson Orin NX/NVIDIA Jetson Orin NX, BIOS 3.1-32827747 03/19/2023\n  Workqueue: events_unbound deferred_probe_work_func\n  pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : nvidia_smmu_context_fault+0x1c/0x158\n  lr : __free_irq+0x1d4/0x2e8\n  sp : ffff80008044b6f0\n  x29: ffff80008044b6f0 x28: ffff000080a60b18 x27: ffffd32b5172e970\n  x26: 0000000000000000 x25: ffff0000802f5aac x24: ffff0000802f5a30\n  x23: ffff0000802f5b60 x22: 0000000000000057 x21: 0000000000000000\n  x20: ffff0000802f5a00 x19: ffff000087d4cd80 x18: ffffffffffffffff\n  x17: 6234362066666666 x16: 6630303078302d30 x15: ffff00008156d888\n  x14: 0000000000000000 x13: ffff0000801db910 x12: ffff00008156d6d0\n  x11: 0000000000000003 x10: ffff0000801db918 x9 : ffffd32b50f94d9c\n  x8 : 1fffe0001032fda1 x7 : ffff00008197ed00 x6 : 000000000000000f\n  x5 : 000000000000010e x4 : 000000000000010e x3 : 0000000000000000\n  x2 : ffffd32b51720cd8 x1 : ffff000087e6f700 x0 : 0000000000000057\n  Call trace:\n   nvidia_smmu_context_fault+0x1c/0x158\n   __free_irq+0x1d4/0x2e8\n   free_irq+0x3c/0x80\n   devm_free_irq+0x64/0xa8\n   arm_smmu_domain_free+0xc4/0x158\n   iommu_domain_free+0x44/0xa0\n   iommu_deinit_device+0xd0/0xf8\n   __iommu_group_remove_device+0xcc/0xe0\n   iommu_bus_notifier+0x64/0xa8\n   notifier_call_chain+0x78/0x148\n   blocking_notifier_call_chain+0x4c/0x90\n   bus_notify+0x44/0x70\n   device_del+0x264/0x3e8\n   pci_remove_bus_device+0x84/0x120\n   pci_remove_root_bus+0x5c/0xc0\n   dw_pcie_host_deinit+0x38/0xe0\n   tegra_pcie_config_rp+0xc0/0x1f0\n   tegra_pcie_dw_probe+0x34c/0x700\n   platform_probe+0x70/0xe8\n   really_probe+0xc8/0x3a0\n   __driver_probe_device+0x84/0x160\n   driver_probe_device+0x44/0x130\n   __device_attach_driver+0xc4/0x170\n   bus_for_each_drv+0x90/0x100\n   __device_attach+0xa8/0x1c8\n   device_initial_probe+0x1c/0x30\n   bus_probe_device+0xb0/0xc0\n   deferred_probe_work_func+0xbc/0x120\n   process_one_work+0x194/0x490\n   worker_thread+0x284/0x3b0\n   kthread+0xf4/0x108\n   ret_from_fork+0x10/0x20\n  Code: a9b97bfd 910003fd a9025bf5 f85a0035 (b94122a1)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable handler is reached through an SMMU context-fault interrupt raised by a device performing faulting DMA, which requires local access to drive a device (VFIO fd, assigned device in a guest, or a device node that issues DMA). There is no remote or adjacent-network path to control DMA target addresses.\nAC:L - An attacker controlling a device behind the SMMU can deterministically generate a context fault by programming DMA to an IOVA that is not mapped, and the miscomputed container_of() offset is a fixed, unconditional error that fires every time the handler runs. No race or unpredictable precondition is involved.\nPR:L - Only ordinary local privileges are needed \u2014 a VFIO-assigned device handed to an unprivileged process or a guest VM, or a userspace-driven DMA engine on Tegra, is enough to provoke the fault; no root or CAP_SYS_ADMIN check exists on the fault-reporting path.\nUI:N - The attacker triggers the DMA fault directly; no action by any other user or administrator is required.\nS:U - The IOMMU still correctly blocks the offending DMA \u2014 the defect is in the fault-reporting handler \u2014 so both the vulnerable and impacted components are the host kernel with no crossing of a DMA or virtualization security boundary.\nC:H - The confused pointer is fetched from the adjacent heap object, and the resulting `bases[]` value is used as the base for readl/readq operations whose results (fsr, fsynr, iova, cbfrsynra) are printed to the kernel log, giving a groomable read primitive with disclosure of kernel memory contents.\nI:H - This is a type confusion in which a pointer field is taken from neighbouring heap memory and then used for register accesses including writel_relaxed(), so the kernel operates on and writes through an attacker-influenceable address.\nA:H - The dereference of the miscomputed pointer produces a fatal oops in hard IRQ context \u2014 as demonstrated by the reported NULL-pointer dereference at 0x120 on Jetson Orin NX \u2014 and can be triggered repeatedly, panicking the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:50.077Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e83de8f05b998e227b48cdeea54cba4c9d66d3aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/65ade5653f5ab5a21635e51d0c65e95f490f5b6f"
        }
      ],
      "title": "iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36884",
    "datePublished": "2024-05-30T15:28:53.894Z",
    "dateReserved": "2024-05-30T15:25:07.065Z",
    "dateUpdated": "2026-08-05T11:31:50.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36884",
      "date": "2026-09-17",
      "epss": "0.00219",
      "percentile": "0.12545"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.8.10\", \"matchCriteriaId\": \"B0D3E543-9D44-48EC-AEFE-B1F1DE163D83\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()\\n\\nThis was missed because of the function pointer indirection.\\n\\nnvidia_smmu_context_fault() is also installed as a irq function, and the\\n\u0027void *\u0027 was changed to a struct arm_smmu_domain. Since the iommu_domain\\nis embedded at a non-zero offset this causes nvidia_smmu_context_fault()\\nto miscompute the offset. Fixup the types.\\n\\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000120\\n  Mem abort info:\\n    ESR = 0x0000000096000004\\n    EC = 0x25: DABT (current EL), IL = 32 bits\\n    SET = 0, FnV = 0\\n    EA = 0, S1PTW = 0\\n    FSC = 0x04: level 0 translation fault\\n  Data abort info:\\n    ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\\n    CM = 0, WnR = 0, TnD = 0, TagAccess = 0\\n    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\\n  user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107c9f000\\n  [0000000000000120] pgd=0000000000000000, p4d=0000000000000000\\n  Internal error: Oops: 0000000096000004 [#1] SMP\\n  Modules linked in:\\n  CPU: 1 PID: 47 Comm: kworker/u25:0 Not tainted 6.9.0-0.rc7.58.eln136.aarch64 #1\\n  Hardware name: Unknown NVIDIA Jetson Orin NX/NVIDIA Jetson Orin NX, BIOS 3.1-32827747 03/19/2023\\n  Workqueue: events_unbound deferred_probe_work_func\\n  pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n  pc : nvidia_smmu_context_fault+0x1c/0x158\\n  lr : __free_irq+0x1d4/0x2e8\\n  sp : ffff80008044b6f0\\n  x29: ffff80008044b6f0 x28: ffff000080a60b18 x27: ffffd32b5172e970\\n  x26: 0000000000000000 x25: ffff0000802f5aac x24: ffff0000802f5a30\\n  x23: ffff0000802f5b60 x22: 0000000000000057 x21: 0000000000000000\\n  x20: ffff0000802f5a00 x19: ffff000087d4cd80 x18: ffffffffffffffff\\n  x17: 6234362066666666 x16: 6630303078302d30 x15: ffff00008156d888\\n  x14: 0000000000000000 x13: ffff0000801db910 x12: ffff00008156d6d0\\n  x11: 0000000000000003 x10: ffff0000801db918 x9 : ffffd32b50f94d9c\\n  x8 : 1fffe0001032fda1 x7 : ffff00008197ed00 x6 : 000000000000000f\\n  x5 : 000000000000010e x4 : 000000000000010e x3 : 0000000000000000\\n  x2 : ffffd32b51720cd8 x1 : ffff000087e6f700 x0 : 0000000000000057\\n  Call trace:\\n   nvidia_smmu_context_fault+0x1c/0x158\\n   __free_irq+0x1d4/0x2e8\\n   free_irq+0x3c/0x80\\n   devm_free_irq+0x64/0xa8\\n   arm_smmu_domain_free+0xc4/0x158\\n   iommu_domain_free+0x44/0xa0\\n   iommu_deinit_device+0xd0/0xf8\\n   __iommu_group_remove_device+0xcc/0xe0\\n   iommu_bus_notifier+0x64/0xa8\\n   notifier_call_chain+0x78/0x148\\n   blocking_notifier_call_chain+0x4c/0x90\\n   bus_notify+0x44/0x70\\n   device_del+0x264/0x3e8\\n   pci_remove_bus_device+0x84/0x120\\n   pci_remove_root_bus+0x5c/0xc0\\n   dw_pcie_host_deinit+0x38/0xe0\\n   tegra_pcie_config_rp+0xc0/0x1f0\\n   tegra_pcie_dw_probe+0x34c/0x700\\n   platform_probe+0x70/0xe8\\n   really_probe+0xc8/0x3a0\\n   __driver_probe_device+0x84/0x160\\n   driver_probe_device+0x44/0x130\\n   __device_attach_driver+0xc4/0x170\\n   bus_for_each_drv+0x90/0x100\\n   __device_attach+0xa8/0x1c8\\n   device_initial_probe+0x1c/0x30\\n   bus_probe_device+0xb0/0xc0\\n   deferred_probe_work_func+0xbc/0x120\\n   process_one_work+0x194/0x490\\n   worker_thread+0x284/0x3b0\\n   kthread+0xf4/0x108\\n   ret_from_fork+0x10/0x20\\n  Code: a9b97bfd 910003fd a9025bf5 f85a0035 (b94122a1)\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: iommu/arm-smmu: use el tipo correcto en nvidia_smmu_context_fault() Esto se omiti\\u00f3 debido a la direcci\\u00f3n indirecta del puntero de funci\\u00f3n. nvidia_smmu_context_fault() tambi\\u00e9n est\\u00e1 instalado como una funci\\u00f3n irq, y \u0027void *\u0027 se cambi\\u00f3 a una estructura arm_smmu_domain. Dado que iommu_domain est\\u00e1 incrustado en un desplazamiento distinto de cero, esto hace que nvidia_smmu_context_fault() calcule mal el desplazamiento. Arregle los tipos. No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\\u00f3n virtual 0000000000000120 Informaci\\u00f3n de cancelaci\\u00f3n de memoria: ESR = 0x0000000096000004 EC = 0x25: DABT (EL actual), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: falla de traducci\\u00f3n de nivel 0 Informaci\\u00f3n de cancelaci\\u00f3n de datos: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 usuario pgtable: p\\u00e1ginas de 4k, VA de 48 bits, pgdp=0000000107c9f000 [0000000000000120] pgd=0000000000000000, p4d=00000000000000000 Error interno: Ups: 0000000096000004 [# 1] M\\u00f3dulos SMP vinculados en: CPU: 1 PID: 47 Comm: kworker/u25: 0 No contaminado 6.9.0-0.rc7.58.eln136.aarch64 #1 Nombre de hardware: Desconocido NVIDIA Jetson Orin NX/NVIDIA Jetson Orin NX, BIOS 3.1-32827747 19/03/2023 Cola de trabajo: events_unbound deferred_probe_work_func pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc: nvidia_smmu_context_fault+0x1c/0x158 lr: __free_irq+0x1d4/0x2e8 sp: ffff80008044b6f0 x29: ffff80008044b6f0 x28: b18 x27: ffffd32b5172e970 x26: 0000000000000000 x25: ffff0000802f5aac x24: ffff0000802f5a30 x23: ffff0000802f5b60 x22: 0000000000000057 x21: 0000000000000000 x20: ffff0000802f5a00 x19: ffff000087d4cd80 x18: ffffff x17: 6234362066666666 x16: 6630303078302d30 x15: ffff00008156d888 x14: 00000000000000000 x13: ffff0000801db910 x12: ffff00008156d6d0 x1 1: 0000000000000003 x10: ffff0000801db918 x9: ffffd32b50f94d9c x8: 1fffe0001032fda1 x7 : ffff00008197ed00 x6 : 000000000000000f x5 : 000000000000010e x4 : 000000000000010e x3 : 00000000000000000 x2 : ffffd32b51720cd8 x1 : ffff00008 7e6f700 x0: 0000000000000057 Rastreo de llamadas: nvidia_smmu_context_fault+0x1c/0x158 __free_irq+0x1d4/0x2e8 free_irq+0x3c/0x80 devm_free_irq+0x64/0xa8 arm_smmu_domain_free+0xc4/ 0x158 iommu_domain_free+0x44/0xa0 iommu_deinit_device+0xd0/0xf8 __iommu_group_remove_device+0xcc/0xe0 iommu_bus_notifier+0x64/0xa8 notifier_call_chain+0x78/0x148 blocking_notifier_call_chain+0x4c/0x9 0 bus_notify+0x44/0x70 dispositivo_del+0x264/0x3e8 pci_remove_bus_device+0x84/0x120 pci_remove_root_bus+0x5c/ 0xc0 dw_pcie_host_deinit+0x38/0xe0 tegra_pcie_config_rp+0xc0/0x1f0 tegra_pcie_dw_probe+0x34c/0x700 platform_probe+0x70/0xe8 very_probe+0xc8/0x3a0 __driver_probe_device+0x84/0x160 _dispositivo+0x44/0x130 __device_attach_driver+0xc4/0x170 bus_for_each_drv+0x90/0x100 __device_attach+0xa8/ 0x1c8 sonda_inicial_dispositivo+0x1c/0x30 dispositivo_probe_bus+0xb0/0xc0 funci\\u00f3n_trabajo_probe_diferida+0xbc/0x120 trabajo_uno_proceso+0x194/0x490 hilo_trabajador+0x284/0x3b0 kthread+0xf4/0x108 ret_from_fork+0x10/0x2 0 C\\u00f3digo: a9b97bfd 910003fd a9025bf5 f85a0035 (b94122a1)\"}]",
      "id": "CVE-2024-36884",
      "lastModified": "2024-11-21T09:22:43.727",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-30T16:15:11.987",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/65ade5653f5ab5a21635e51d0c65e95f490f5b6f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e83de8f05b998e227b48cdeea54cba4c9d66d3aa\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/65ade5653f5ab5a21635e51d0c65e95f490f5b6f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e83de8f05b998e227b48cdeea54cba4c9d66d3aa\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36884\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:11.987\",\"lastModified\":\"2026-08-04T11:18:26.803\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()\\n\\nThis was missed because of the function pointer indirection.\\n\\nnvidia_smmu_context_fault() is also installed as a irq function, and the\\n\u0027void *\u0027 was changed to a struct arm_smmu_domain. Since the iommu_domain\\nis embedded at a non-zero offset this causes nvidia_smmu_context_fault()\\nto miscompute the offset. Fixup the types.\\n\\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000120\\n  Mem abort info:\\n    ESR = 0x0000000096000004\\n    EC = 0x25: DABT (current EL), IL = 32 bits\\n    SET = 0, FnV = 0\\n    EA = 0, S1PTW = 0\\n    FSC = 0x04: level 0 translation fault\\n  Data abort info:\\n    ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\\n    CM = 0, WnR = 0, TnD = 0, TagAccess = 0\\n    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\\n  user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107c9f000\\n  [0000000000000120] pgd=0000000000000000, p4d=0000000000000000\\n  Internal error: Oops: 0000000096000004 [#1] SMP\\n  Modules linked in:\\n  CPU: 1 PID: 47 Comm: kworker/u25:0 Not tainted 6.9.0-0.rc7.58.eln136.aarch64 #1\\n  Hardware name: Unknown NVIDIA Jetson Orin NX/NVIDIA Jetson Orin NX, BIOS 3.1-32827747 03/19/2023\\n  Workqueue: events_unbound deferred_probe_work_func\\n  pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n  pc : nvidia_smmu_context_fault+0x1c/0x158\\n  lr : __free_irq+0x1d4/0x2e8\\n  sp : ffff80008044b6f0\\n  x29: ffff80008044b6f0 x28: ffff000080a60b18 x27: ffffd32b5172e970\\n  x26: 0000000000000000 x25: ffff0000802f5aac x24: ffff0000802f5a30\\n  x23: ffff0000802f5b60 x22: 0000000000000057 x21: 0000000000000000\\n  x20: ffff0000802f5a00 x19: ffff000087d4cd80 x18: ffffffffffffffff\\n  x17: 6234362066666666 x16: 6630303078302d30 x15: ffff00008156d888\\n  x14: 0000000000000000 x13: ffff0000801db910 x12: ffff00008156d6d0\\n  x11: 0000000000000003 x10: ffff0000801db918 x9 : ffffd32b50f94d9c\\n  x8 : 1fffe0001032fda1 x7 : ffff00008197ed00 x6 : 000000000000000f\\n  x5 : 000000000000010e x4 : 000000000000010e x3 : 0000000000000000\\n  x2 : ffffd32b51720cd8 x1 : ffff000087e6f700 x0 : 0000000000000057\\n  Call trace:\\n   nvidia_smmu_context_fault+0x1c/0x158\\n   __free_irq+0x1d4/0x2e8\\n   free_irq+0x3c/0x80\\n   devm_free_irq+0x64/0xa8\\n   arm_smmu_domain_free+0xc4/0x158\\n   iommu_domain_free+0x44/0xa0\\n   iommu_deinit_device+0xd0/0xf8\\n   __iommu_group_remove_device+0xcc/0xe0\\n   iommu_bus_notifier+0x64/0xa8\\n   notifier_call_chain+0x78/0x148\\n   blocking_notifier_call_chain+0x4c/0x90\\n   bus_notify+0x44/0x70\\n   device_del+0x264/0x3e8\\n   pci_remove_bus_device+0x84/0x120\\n   pci_remove_root_bus+0x5c/0xc0\\n   dw_pcie_host_deinit+0x38/0xe0\\n   tegra_pcie_config_rp+0xc0/0x1f0\\n   tegra_pcie_dw_probe+0x34c/0x700\\n   platform_probe+0x70/0xe8\\n   really_probe+0xc8/0x3a0\\n   __driver_probe_device+0x84/0x160\\n   driver_probe_device+0x44/0x130\\n   __device_attach_driver+0xc4/0x170\\n   bus_for_each_drv+0x90/0x100\\n   __device_attach+0xa8/0x1c8\\n   device_initial_probe+0x1c/0x30\\n   bus_probe_device+0xb0/0xc0\\n   deferred_probe_work_func+0xbc/0x120\\n   process_one_work+0x194/0x490\\n   worker_thread+0x284/0x3b0\\n   kthread+0xf4/0x108\\n   ret_from_fork+0x10/0x20\\n  Code: a9b97bfd 910003fd a9025bf5 f85a0035 (b94122a1)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iommu/arm-smmu: use el tipo correcto en nvidia_smmu_context_fault() Esto se omiti\u00f3 debido a la direcci\u00f3n indirecta del puntero de funci\u00f3n. nvidia_smmu_context_fault() tambi\u00e9n est\u00e1 instalado como una funci\u00f3n irq, y \u0027void *\u0027 se cambi\u00f3 a una estructura arm_smmu_domain. Dado que iommu_domain est\u00e1 incrustado en un desplazamiento distinto de cero, esto hace que nvidia_smmu_context_fault() calcule mal el desplazamiento. Arregle los tipos. No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\u00f3n virtual 0000000000000120 Informaci\u00f3n de cancelaci\u00f3n de memoria: ESR = 0x0000000096000004 EC = 0x25: DABT (EL actual), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: falla de traducci\u00f3n de nivel 0 Informaci\u00f3n de cancelaci\u00f3n de datos: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 usuario pgtable: p\u00e1ginas de 4k, VA de 48 bits, pgdp=0000000107c9f000 [0000000000000120] pgd=0000000000000000, p4d=00000000000000000 Error interno: Ups: 0000000096000004 [# 1] M\u00f3dulos SMP vinculados en: CPU: 1 PID: 47 Comm: kworker/u25: 0 No contaminado 6.9.0-0.rc7.58.eln136.aarch64 #1 Nombre de hardware: Desconocido NVIDIA Jetson Orin NX/NVIDIA Jetson Orin NX, BIOS 3.1-32827747 19/03/2023 Cola de trabajo: events_unbound deferred_probe_work_func pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc: nvidia_smmu_context_fault+0x1c/0x158 lr: __free_irq+0x1d4/0x2e8 sp: ffff80008044b6f0 x29: ffff80008044b6f0 x28: b18 x27: ffffd32b5172e970 x26: 0000000000000000 x25: ffff0000802f5aac x24: ffff0000802f5a30 x23: ffff0000802f5b60 x22: 0000000000000057 x21: 0000000000000000 x20: ffff0000802f5a00 x19: ffff000087d4cd80 x18: ffffff x17: 6234362066666666 x16: 6630303078302d30 x15: ffff00008156d888 x14: 00000000000000000 x13: ffff0000801db910 x12: ffff00008156d6d0 x1 1: 0000000000000003 x10: ffff0000801db918 x9: ffffd32b50f94d9c x8: 1fffe0001032fda1 x7 : ffff00008197ed00 x6 : 000000000000000f x5 : 000000000000010e x4 : 000000000000010e x3 : 00000000000000000 x2 : ffffd32b51720cd8 x1 : ffff00008 7e6f700 x0: 0000000000000057 Rastreo de llamadas: nvidia_smmu_context_fault+0x1c/0x158 __free_irq+0x1d4/0x2e8 free_irq+0x3c/0x80 devm_free_irq+0x64/0xa8 arm_smmu_domain_free+0xc4/ 0x158 iommu_domain_free+0x44/0xa0 iommu_deinit_device+0xd0/0xf8 __iommu_group_remove_device+0xcc/0xe0 iommu_bus_notifier+0x64/0xa8 notifier_call_chain+0x78/0x148 blocking_notifier_call_chain+0x4c/0x9 0 bus_notify+0x44/0x70 dispositivo_del+0x264/0x3e8 pci_remove_bus_device+0x84/0x120 pci_remove_root_bus+0x5c/ 0xc0 dw_pcie_host_deinit+0x38/0xe0 tegra_pcie_config_rp+0xc0/0x1f0 tegra_pcie_dw_probe+0x34c/0x700 platform_probe+0x70/0xe8 very_probe+0xc8/0x3a0 __driver_probe_device+0x84/0x160 _dispositivo+0x44/0x130 __device_attach_driver+0xc4/0x170 bus_for_each_drv+0x90/0x100 __device_attach+0xa8/ 0x1c8 sonda_inicial_dispositivo+0x1c/0x30 dispositivo_probe_bus+0xb0/0xc0 funci\u00f3n_trabajo_probe_diferida+0xbc/0x120 trabajo_uno_proceso+0x194/0x490 hilo_trabajador+0x284/0x3b0 kthread+0xf4/0x108 ret_from_fork+0x10/0x2 0 C\u00f3digo: a9b97bfd 910003fd a9025bf5 f85a0035 (b94122a1)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e0976331ad114af8e379e18483c346c6c79ca858\",\"lessThan\":\"e83de8f05b998e227b48cdeea54cba4c9d66d3aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e0976331ad114af8e379e18483c346c6c79ca858\",\"lessThan\":\"65ade5653f5ab5a21635e51d0c65e95f490f5b6f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.10\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-17T17:32:53.413212Z\",\"id\":\"CVE-2024-36884\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.10\",\"matchCriteriaId\":\"B0D3E543-9D44-48EC-AEFE-B1F1DE163D83\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/65ade5653f5ab5a21635e51d0c65e95f490f5b6f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e83de8f05b998e227b48cdeea54cba4c9d66d3aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/65ade5653f5ab5a21635e51d0c65e95f490f5b6f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e83de8f05b998e227b48cdeea54cba4c9d66d3aa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:57:40+00:00",
      "cve": "CVE-2024-36884",
      "id": "CVE-2024-36884",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "112",
      "product_status:known_not_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36884.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:30:11Z",
      "cve": "CVE-2024-36884",
      "id": "CVE-2024-36884",
      "initial_release_date": "2024-06-01T02:23:52Z",
      "product_status:known_not_affected": "385",
      "product_status:recommended": "47",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36884",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36884.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e83de8f05b998e227b48cdeea54cba4c9d66d3aa\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/65ade5653f5ab5a21635e51d0c65e95f490f5b6f\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:49.220Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36884\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T17:32:53.413212Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T17:32:54.609Z\"}}], \"cna\": {\"title\": \"iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable handler is reached through an SMMU context-fault interrupt raised by a device performing faulting DMA, which requires local access to drive a device (VFIO fd, assigned device in a guest, or a device node that issues DMA). There is no remote or adjacent-network path to control DMA target addresses.\\nAC:L - An attacker controlling a device behind the SMMU can deterministically generate a context fault by programming DMA to an IOVA that is not mapped, and the miscomputed container_of() offset is a fixed, unconditional error that fires every time the handler runs. No race or unpredictable precondition is involved.\\nPR:L - Only ordinary local privileges are needed \\u2014 a VFIO-assigned device handed to an unprivileged process or a guest VM, or a userspace-driven DMA engine on Tegra, is enough to provoke the fault; no root or CAP_SYS_ADMIN check exists on the fault-reporting path.\\nUI:N - The attacker triggers the DMA fault directly; no action by any other user or administrator is required.\\nS:U - The IOMMU still correctly blocks the offending DMA \\u2014 the defect is in the fault-reporting handler \\u2014 so both the vulnerable and impacted components are the host kernel with no crossing of a DMA or virtualization security boundary.\\nC:H - The confused pointer is fetched from the adjacent heap object, and the resulting `bases[]` value is used as the base for readl/readq operations whose results (fsr, fsynr, iova, cbfrsynra) are printed to the kernel log, giving a groomable read primitive with disclosure of kernel memory contents.\\nI:H - This is a type confusion in which a pointer field is taken from neighbouring heap memory and then used for register accesses including writel_relaxed(), so the kernel operates on and writes through an attacker-influenceable address.\\nA:H - The dereference of the miscomputed pointer produces a fatal oops in hard IRQ context \\u2014 as demonstrated by the reported NULL-pointer dereference at 0x120 on Jetson Orin NX \\u2014 and can be triggered repeatedly, panicking the machine.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e0976331ad114af8e379e18483c346c6c79ca858\", \"lessThan\": \"e83de8f05b998e227b48cdeea54cba4c9d66d3aa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e0976331ad114af8e379e18483c346c6c79ca858\", \"lessThan\": \"65ade5653f5ab5a21635e51d0c65e95f490f5b6f\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e83de8f05b998e227b48cdeea54cba4c9d66d3aa\"}, {\"url\": \"https://git.kernel.org/stable/c/65ade5653f5ab5a21635e51d0c65e95f490f5b6f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()\\n\\nThis was missed because of the function pointer indirection.\\n\\nnvidia_smmu_context_fault() is also installed as a irq function, and the\\n\u0027void *\u0027 was changed to a struct arm_smmu_domain. Since the iommu_domain\\nis embedded at a non-zero offset this causes nvidia_smmu_context_fault()\\nto miscompute the offset. Fixup the types.\\n\\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000120\\n  Mem abort info:\\n    ESR = 0x0000000096000004\\n    EC = 0x25: DABT (current EL), IL = 32 bits\\n    SET = 0, FnV = 0\\n    EA = 0, S1PTW = 0\\n    FSC = 0x04: level 0 translation fault\\n  Data abort info:\\n    ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\\n    CM = 0, WnR = 0, TnD = 0, TagAccess = 0\\n    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\\n  user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107c9f000\\n  [0000000000000120] pgd=0000000000000000, p4d=0000000000000000\\n  Internal error: Oops: 0000000096000004 [#1] SMP\\n  Modules linked in:\\n  CPU: 1 PID: 47 Comm: kworker/u25:0 Not tainted 6.9.0-0.rc7.58.eln136.aarch64 #1\\n  Hardware name: Unknown NVIDIA Jetson Orin NX/NVIDIA Jetson Orin NX, BIOS 3.1-32827747 03/19/2023\\n  Workqueue: events_unbound deferred_probe_work_func\\n  pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n  pc : nvidia_smmu_context_fault+0x1c/0x158\\n  lr : __free_irq+0x1d4/0x2e8\\n  sp : ffff80008044b6f0\\n  x29: ffff80008044b6f0 x28: ffff000080a60b18 x27: ffffd32b5172e970\\n  x26: 0000000000000000 x25: ffff0000802f5aac x24: ffff0000802f5a30\\n  x23: ffff0000802f5b60 x22: 0000000000000057 x21: 0000000000000000\\n  x20: ffff0000802f5a00 x19: ffff000087d4cd80 x18: ffffffffffffffff\\n  x17: 6234362066666666 x16: 6630303078302d30 x15: ffff00008156d888\\n  x14: 0000000000000000 x13: ffff0000801db910 x12: ffff00008156d6d0\\n  x11: 0000000000000003 x10: ffff0000801db918 x9 : ffffd32b50f94d9c\\n  x8 : 1fffe0001032fda1 x7 : ffff00008197ed00 x6 : 000000000000000f\\n  x5 : 000000000000010e x4 : 000000000000010e x3 : 0000000000000000\\n  x2 : ffffd32b51720cd8 x1 : ffff000087e6f700 x0 : 0000000000000057\\n  Call trace:\\n   nvidia_smmu_context_fault+0x1c/0x158\\n   __free_irq+0x1d4/0x2e8\\n   free_irq+0x3c/0x80\\n   devm_free_irq+0x64/0xa8\\n   arm_smmu_domain_free+0xc4/0x158\\n   iommu_domain_free+0x44/0xa0\\n   iommu_deinit_device+0xd0/0xf8\\n   __iommu_group_remove_device+0xcc/0xe0\\n   iommu_bus_notifier+0x64/0xa8\\n   notifier_call_chain+0x78/0x148\\n   blocking_notifier_call_chain+0x4c/0x90\\n   bus_notify+0x44/0x70\\n   device_del+0x264/0x3e8\\n   pci_remove_bus_device+0x84/0x120\\n   pci_remove_root_bus+0x5c/0xc0\\n   dw_pcie_host_deinit+0x38/0xe0\\n   tegra_pcie_config_rp+0xc0/0x1f0\\n   tegra_pcie_dw_probe+0x34c/0x700\\n   platform_probe+0x70/0xe8\\n   really_probe+0xc8/0x3a0\\n   __driver_probe_device+0x84/0x160\\n   driver_probe_device+0x44/0x130\\n   __device_attach_driver+0xc4/0x170\\n   bus_for_each_drv+0x90/0x100\\n   __device_attach+0xa8/0x1c8\\n   device_initial_probe+0x1c/0x30\\n   bus_probe_device+0xb0/0xc0\\n   deferred_probe_work_func+0xbc/0x120\\n   process_one_work+0x194/0x490\\n   worker_thread+0x284/0x3b0\\n   kthread+0xf4/0x108\\n   ret_from_fork+0x10/0x20\\n  Code: a9b97bfd 910003fd a9025bf5 f85a0035 (b94122a1)\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.10\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:50.077Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36884\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:50.077Z\", \"dateReserved\": \"2024-05-30T15:25:07.065Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:28:53.894Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.