Critical IOMMU Misconfiguration in Linux Kernel Affecting Debian Packages
Summary
CVE-2024-57999: In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW Power Hypervisor can possibily allocate MMIO window intersecting with Dynamic DMA Windo... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of hardware architectures and is known for its stability and performance. The vulnerability in question affects the powerpc/pseries/iommu subsystem, which is responsible for managing memory-mapped I/O (MMIO) and Direct Memory Access (DMA) operations. This vulnerability can lead to system crashes and instability during boot processes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where the IOMMU incorrectly marks the MMIO range in the Dynamic DMA Window (DDW). This misconfiguration can allow the Power Hypervisor to allocate an MMIO window that intersects with the DDW range, which is over 32-bit addressing. As a result, the MMIO pages are not marked as reserved, causing the IOMMU to map DMA buffers incorrectly. This leads to kernel data access errors and system crashes (OOPS) during boot, as evidenced by the stack trace provided in the vulnerability report. The root cause lies in the incorrect handling of index types and address shifting in the code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid using configurations that may lead to MMIO and DMA conflicts until the patch is applied.
Conclusion
The CVE-2024-57999 vulnerability in the Linux kernel poses a significant risk to systems utilizing the powerpc architecture, leading to potential crashes during boot due to incorrect IOMMU configurations. Users are encouraged to update their Linux packages to the latest versions to mitigate this risk. For those unable to update immediately, it is advisable to monitor configurations closely.
See every vulnerability recorded for linux →
FAQ
CVE-2024-57999 is a vulnerability in the Linux kernel that affects the IOMMU subsystem, leading to potential system crashes during boot due to incorrect MMIO range handling.
This vulnerability can cause kernel data access errors, resulting in system instability and crashes during the boot process, particularly on systems using the powerpc architecture.
Yes, a patch is available in the updated versions of the Linux kernel. Users should update their systems to the latest version to mitigate this vulnerability.
While there are no specific workarounds, it is advisable to avoid configurations that may lead to MMIO and DMA conflicts until the patch is applied.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
