cve/published/2024/CVE-2024-26709.json

{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: Fix the missing iommu_group_put() during platform domain attach\n\nThe function spapr_tce_platform_iommu_attach_dev() is missing to call\niommu_group_put() when the domain is already set. This refcount leak\nshows up with BUG_ON() during DLPAR remove operation as:\n\n  KernelBug: Kernel bug in state 'None': kernel BUG at arch/powerpc/platforms/pseries/iommu.c:100!\n  Oops: Exception in kernel mode, sig: 5 [#1]\n  LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=8192 NUMA pSeries\n  <snip>\n  Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_016) hv:phyp pSeries\n  NIP:  c0000000000ff4d4 LR: c0000000000ff4cc CTR: 0000000000000000\n  REGS: c0000013aed5f840 TRAP: 0700   Tainted: G          I         (6.8.0-rc3-autotest-g99bd3cb0d12e)\n  MSR:  8000000000029033 <SF,EE,ME,IR,DR,RI,LE>  CR: 44002402  XER: 20040000\n  CFAR: c000000000a0d170 IRQMASK: 0\n  ...\n  NIP iommu_reconfig_notifier+0x94/0x200\n  LR  iommu_reconfig_notifier+0x8c/0x200\n  Call Trace:\n    iommu_reconfig_notifier+0x8c/0x200 (unreliable)\n    notifier_call_chain+0xb8/0x19c\n    blocking_notifier_call_chain+0x64/0x98\n    of_reconfig_notify+0x44/0xdc\n    of_detach_node+0x78/0xb0\n    ofdt_write.part.0+0x86c/0xbb8\n    proc_reg_write+0xf4/0x150\n    vfs_write+0xf8/0x488\n    ksys_write+0x84/0x140\n    system_call_exception+0x138/0x330\n    system_call_vectored_common+0x15c/0x2ec\n\nThe patch adds the missing iommu_group_put() call."
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "arch/powerpc/kernel/iommu.c"
               ],
               "versions": [
                  {
                     "version": "a8ca9fc9134c1a43e6d4db7ff59496bbd7075def",
                     "lessThan": "c90fdea9cac9eb419fc266e75d625cb60c8f7f6c",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "a8ca9fc9134c1a43e6d4db7ff59496bbd7075def",
                     "lessThan": "0846dd77c8349ec92ca0079c9c71d130f34cb192",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "arch/powerpc/kernel/iommu.c"
               ],
               "versions": [
                  {
                     "version": "6.7",
                     "status": "affected"
                  },
                  {
                     "version": "0",
                     "lessThan": "6.7",
                     "status": "unaffected",
                     "versionType": "semver"
                  },
                  {
                     "version": "6.7.6",
                     "lessThanOrEqual": "6.7.*",
                     "status": "unaffected",
                     "versionType": "semver"
                  },
                  {
                     "version": "6.8",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "cpeApplicability": [
            {
               "nodes": [
                  {
                     "operator": "OR",
                     "negate": false,
                     "cpeMatch": [
                        {
                           "vulnerable": true,
                           "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           "versionStartIncluding": "6.7",
                           "versionEndExcluding": "6.7.6"
                        },
                        {
                           "vulnerable": true,
                           "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                           "versionStartIncluding": "6.7",
                           "versionEndExcluding": "6.8"
                        }
                     ]
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/c90fdea9cac9eb419fc266e75d625cb60c8f7f6c"
            },
            {
               "url": "https://git.kernel.org/stable/c/0846dd77c8349ec92ca0079c9c71d130f34cb192"
            }
         ],
         "title": "powerpc/iommu: Fix the missing iommu_group_put() during platform domain attach",
         "x_generator": {
            "engine": "bippy-1.2.0"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2024-26709",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}