cve-2024-44976
Vulnerability from cvelistv5
Published
2024-09-04 19:54
Modified
2024-12-19 09:19
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ata: pata_macio: Fix DMA table overflow Kolbjørn and Jonáš reported that their 32-bit PowerMacs were crashing in pata-macio since commit 09fe2bfa6b83 ("ata: pata_macio: Fix max_segment_size with PAGE_SIZE == 64K"). For example: kernel BUG at drivers/ata/pata_macio.c:544! Oops: Exception in kernel mode, sig: 5 [#1] BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 DEBUG_PAGEALLOC PowerMac ... NIP pata_macio_qc_prep+0xf4/0x190 LR pata_macio_qc_prep+0xfc/0x190 Call Trace: 0xc1421660 (unreliable) ata_qc_issue+0x14c/0x2d4 __ata_scsi_queuecmd+0x200/0x53c ata_scsi_queuecmd+0x50/0xe0 scsi_queue_rq+0x788/0xb1c __blk_mq_issue_directly+0x58/0xf4 blk_mq_plug_issue_direct+0x8c/0x1b4 blk_mq_flush_plug_list.part.0+0x584/0x5e0 __blk_flush_plug+0xf8/0x194 __submit_bio+0x1b8/0x2e0 submit_bio_noacct_nocheck+0x230/0x304 btrfs_work_helper+0x200/0x338 process_one_work+0x1a8/0x338 worker_thread+0x364/0x4c0 kthread+0x100/0x104 start_kernel_thread+0x10/0x14 That commit increased max_segment_size to 64KB, with the justification that the SCSI core was already using that size when PAGE_SIZE == 64KB, and that there was existing logic to split over-sized requests. However with a sufficiently large request, the splitting logic causes each sg to be split into two commands in the DMA table, leading to overflow of the DMA table, triggering the BUG_ON(). With default settings the bug doesn't trigger, because the request size is limited by max_sectors_kb == 1280, however max_sectors_kb can be increased, and apparently some distros do that by default using udev rules. Fix the bug for 4KB kernels by reverting to the old max_segment_size. For 64KB kernels the sg_tablesize needs to be halved, to allow for the possibility that each sg will be split into two.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/709e4c8f78e156ab332297bdd87527ec3da4e2d4Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/822c8020aebcf5804a143b891e34f29873fee5e2Patch
Impacted products
Vendor Product Version
Linux Linux Version: 6.10
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44976",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:24:17.288703Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:14.799Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ata/pata_macio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "709e4c8f78e156ab332297bdd87527ec3da4e2d4",
              "status": "affected",
              "version": "09fe2bfa6b83f865126ce3964744863f69a4a030",
              "versionType": "git"
            },
            {
              "lessThan": "822c8020aebcf5804a143b891e34f29873fee5e2",
              "status": "affected",
              "version": "09fe2bfa6b83f865126ce3964744863f69a4a030",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ata/pata_macio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: pata_macio: Fix DMA table overflow\n\nKolbj\u00f8rn and Jon\u00e1\u0161 reported that their 32-bit PowerMacs were crashing\nin pata-macio since commit 09fe2bfa6b83 (\"ata: pata_macio: Fix\nmax_segment_size with PAGE_SIZE == 64K\").\n\nFor example:\n\n  kernel BUG at drivers/ata/pata_macio.c:544!\n  Oops: Exception in kernel mode, sig: 5 [#1]\n  BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 DEBUG_PAGEALLOC PowerMac\n  ...\n  NIP pata_macio_qc_prep+0xf4/0x190\n  LR  pata_macio_qc_prep+0xfc/0x190\n  Call Trace:\n    0xc1421660 (unreliable)\n    ata_qc_issue+0x14c/0x2d4\n    __ata_scsi_queuecmd+0x200/0x53c\n    ata_scsi_queuecmd+0x50/0xe0\n    scsi_queue_rq+0x788/0xb1c\n    __blk_mq_issue_directly+0x58/0xf4\n    blk_mq_plug_issue_direct+0x8c/0x1b4\n    blk_mq_flush_plug_list.part.0+0x584/0x5e0\n    __blk_flush_plug+0xf8/0x194\n    __submit_bio+0x1b8/0x2e0\n    submit_bio_noacct_nocheck+0x230/0x304\n    btrfs_work_helper+0x200/0x338\n    process_one_work+0x1a8/0x338\n    worker_thread+0x364/0x4c0\n    kthread+0x100/0x104\n    start_kernel_thread+0x10/0x14\n\nThat commit increased max_segment_size to 64KB, with the justification\nthat the SCSI core was already using that size when PAGE_SIZE == 64KB,\nand that there was existing logic to split over-sized requests.\n\nHowever with a sufficiently large request, the splitting logic causes\neach sg to be split into two commands in the DMA table, leading to\noverflow of the DMA table, triggering the BUG_ON().\n\nWith default settings the bug doesn\u0027t trigger, because the request size\nis limited by max_sectors_kb == 1280, however max_sectors_kb can be\nincreased, and apparently some distros do that by default using udev\nrules.\n\nFix the bug for 4KB kernels by reverting to the old max_segment_size.\n\nFor 64KB kernels the sg_tablesize needs to be halved, to allow for the\npossibility that each sg will be split into two."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:19:28.821Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/709e4c8f78e156ab332297bdd87527ec3da4e2d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/822c8020aebcf5804a143b891e34f29873fee5e2"
        }
      ],
      "title": "ata: pata_macio: Fix DMA table overflow",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44976",
    "datePublished": "2024-09-04T19:54:28.282Z",
    "dateReserved": "2024-08-21T05:34:56.669Z",
    "dateUpdated": "2024-12-19T09:19:28.821Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-44976\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-04T20:15:07.223\",\"lastModified\":\"2024-10-10T17:50:14.863\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nata: pata_macio: Fix DMA table overflow\\n\\nKolbj\u00f8rn and Jon\u00e1\u0161 reported that their 32-bit PowerMacs were crashing\\nin pata-macio since commit 09fe2bfa6b83 (\\\"ata: pata_macio: Fix\\nmax_segment_size with PAGE_SIZE == 64K\\\").\\n\\nFor example:\\n\\n  kernel BUG at drivers/ata/pata_macio.c:544!\\n  Oops: Exception in kernel mode, sig: 5 [#1]\\n  BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 DEBUG_PAGEALLOC PowerMac\\n  ...\\n  NIP pata_macio_qc_prep+0xf4/0x190\\n  LR  pata_macio_qc_prep+0xfc/0x190\\n  Call Trace:\\n    0xc1421660 (unreliable)\\n    ata_qc_issue+0x14c/0x2d4\\n    __ata_scsi_queuecmd+0x200/0x53c\\n    ata_scsi_queuecmd+0x50/0xe0\\n    scsi_queue_rq+0x788/0xb1c\\n    __blk_mq_issue_directly+0x58/0xf4\\n    blk_mq_plug_issue_direct+0x8c/0x1b4\\n    blk_mq_flush_plug_list.part.0+0x584/0x5e0\\n    __blk_flush_plug+0xf8/0x194\\n    __submit_bio+0x1b8/0x2e0\\n    submit_bio_noacct_nocheck+0x230/0x304\\n    btrfs_work_helper+0x200/0x338\\n    process_one_work+0x1a8/0x338\\n    worker_thread+0x364/0x4c0\\n    kthread+0x100/0x104\\n    start_kernel_thread+0x10/0x14\\n\\nThat commit increased max_segment_size to 64KB, with the justification\\nthat the SCSI core was already using that size when PAGE_SIZE == 64KB,\\nand that there was existing logic to split over-sized requests.\\n\\nHowever with a sufficiently large request, the splitting logic causes\\neach sg to be split into two commands in the DMA table, leading to\\noverflow of the DMA table, triggering the BUG_ON().\\n\\nWith default settings the bug doesn\u0027t trigger, because the request size\\nis limited by max_sectors_kb == 1280, however max_sectors_kb can be\\nincreased, and apparently some distros do that by default using udev\\nrules.\\n\\nFix the bug for 4KB kernels by reverting to the old max_segment_size.\\n\\nFor 64KB kernels the sg_tablesize needs to be halved, to allow for the\\npossibility that each sg will be split into two.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ata: pata_macio: Fix DMA table overflow Kolbj\u00f8rn y Jon\u00e1\u0161 informaron que sus PowerMacs de 32 bits fallaban en pata-macio desde el commit 09fe2bfa6b83 (\\\"ata: pata_macio: Fix max_segment_size with PAGE_SIZE == 64K\\\"). Por ejemplo: \u00a1ERROR del kernel en drivers/ata/pata_macio.c:544! Ups: Excepci\u00f3n en modo kernel, firma: 5 [#1] BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 DEBUG_PAGEALLOC PowerMac ... NIP pata_macio_qc_prep+0xf4/0x190 LR pata_macio_qc_prep+0xfc/0x190 Rastreo de llamadas: 0xc1421660 (no confiable) ata_qc_issue+0x14c/0x2d4 __ata_scsi_queuecmd+0x200/0x53c ata_scsi_queuecmd+0x50/0xe0 scsi_queue_rq+0x788/0xb1c __blk_mq_issue_directly+0x58/0xf4 blk_mq_plug_issue_direct+0x8c/0x1b4 blk_mq_flush_plug_list.part.0+0x584/0x5e0 __blk_flush_plug+0xf8/0x194 __submit_bio+0x1b8/0x2e0 submission_bio_noacct_nocheck+0x230/0x304 btrfs_work_helper+0x200/0x338 process_one_work+0x1a8/0x338 worker_thread+0x364/0x4c0 kthread+0x100/0x104 start_kernel_thread+0x10/0x14 Esa confirmaci\u00f3n aument\u00f3 max_segment_size a 64 KB, con la justificaci\u00f3n de que el n\u00facleo SCSI ya estaba usando ese tama\u00f1o cuando PAGE_SIZE == 64 KB, y que exist\u00eda una l\u00f3gica para dividir las solicitudes de gran tama\u00f1o. Sin embargo, con una solicitud lo suficientemente grande, la l\u00f3gica de divisi\u00f3n hace que cada sg se divida en dos comandos en la tabla DMA, lo que provoca un desbordamiento de la tabla DMA y activa el BUG_ON(). Con la configuraci\u00f3n predeterminada, el error no se activa, porque el tama\u00f1o de la solicitud est\u00e1 limitado por max_sectors_kb == 1280, sin embargo, max_sectors_kb se puede aumentar y, aparentemente, algunas distribuciones lo hacen de forma predeterminada utilizando reglas de udev. Corrija el error para los n\u00facleos de 4 KB volviendo al antiguo max_segment_size. Para los n\u00facleos de 64 KB, el sg_tablesize debe reducirse a la mitad, para permitir la posibilidad de que cada sg se divida en dos.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.10.7\",\"matchCriteriaId\":\"E55C1263-DF43-41EF-8DA8-2BA68DF4FFFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/709e4c8f78e156ab332297bdd87527ec3da4e2d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/822c8020aebcf5804a143b891e34f29873fee5e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.