Critical IOMMU Misconfiguration in Linux Kernel - CVE-2024-57999
Summary
DEBIAN-CVE-2024-57999: In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW Power Hypervisor can possibily allocate MMIO window intersecting with Dynamic DMA Windo... Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various environments, from personal computers to servers and embedded systems. This vulnerability affects the Linux kernel versions prior to 6.12.13-1, specifically in Debian 13 and 14 distributions, where it exposes systems to potential crashes during boot due to improper handling of MMIO ranges.
Vulnerability Detail
In the Linux kernel, a vulnerability exists in the powerpc/pseries/iommu subsystem where the IOMMU incorrectly marks the MMIO range in the Dynamic DMA Window (DDW). This misconfiguration allows the Power Hypervisor to allocate an MMIO window that intersects with the DDW range, leading to kernel data access errors. The failure to reserve these MMIO pages results in a crash (LPAR to OOPS) during system boot, causing significant operational disruptions.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid using affected kernel versions until they can be updated to the patched version.
Conclusion
The CVE-2024-57999 vulnerability in the Linux kernel poses a significant risk to systems running affected versions. It is crucial for users to update their kernels to the patched version to mitigate the risk of crashes and ensure system stability. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2024-57999 is a vulnerability in the Linux kernel that affects the IOMMU subsystem, leading to potential crashes during system boot.
The vulnerability affects Linux kernel versions prior to 6.12.13-1 in Debian 13 and 14.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability can cause the system to crash during boot, leading to downtime and potential data loss.
Yes, the permanent fix is to update the Linux kernel to version 6.12.13-1 or later, which addresses the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
