Lucene search

K
ubuntucveUbuntu.comUB:CVE-2024-26847
HistoryApr 17, 2024 - 12:00 a.m.

CVE-2024-26847

2024-04-1700:00:00
ubuntu.com
ubuntu.com
5
linux kernel
cve-2024-26847
powerpc/rtas
vulnerability
misspelling
firmware behavior
device tree
rtas function table
kernel warning

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

In the Linux kernel, the following vulnerability has been resolved:
powerpc/rtas: use correct function name for resetting TCE tables The PAPR
spec spells the function name as “ibm,reset-pe-dma-windows” but in practice
firmware uses the singular form: “ibm,reset-pe-dma-window” in the device
tree. Since we have the wrong spelling in the RTAS function table, reverse
lookups (token -> name) fail and warn: unexpected failed lookup for token
86 WARNING: CPU: 1 PID: 545 at arch/powerpc/kernel/rtas.c:659
__do_enter_rtas_trace+0x2a4/0x2b4 CPU: 1 PID: 545 Comm: systemd-udevd Not
tainted 6.8.0-rc4 #30 Hardware name: IBM,9105-22A POWER10 (raw) 0x800200
0xf000006 of:IBM,FW1060.00 (NL1060_028) hv:phyp pSeries NIP
[c0000000000417f0] __do_enter_rtas_trace+0x2a4/0x2b4 LR [c0000000000417ec]
__do_enter_rtas_trace+0x2a0/0x2b4 Call Trace:
__do_enter_rtas_trace+0x2a0/0x2b4 (unreliable) rtas_call+0x1f8/0x3e0
enable_ddw.constprop.0+0x4d0/0xc84 dma_iommu_dma_supported+0xe8/0x24c
dma_set_mask+0x5c/0xd8 mlx5_pci_init.constprop.0+0xf0/0x46c [mlx5_core]
probe_one+0xfc/0x32c [mlx5_core] local_pci_probe+0x68/0x12c
pci_call_probe+0x68/0x1ec pci_device_probe+0xbc/0x1a8
really_probe+0x104/0x570 __driver_probe_device+0xb8/0x224
driver_probe_device+0x54/0x130 __driver_attach+0x158/0x2b0
bus_for_each_dev+0xa8/0x120 driver_attach+0x34/0x48
bus_add_driver+0x174/0x304 driver_register+0x8c/0x1c4
__pci_register_driver+0x68/0x7c mlx5_init+0xb8/0x118 [mlx5_core]
do_one_initcall+0x60/0x388 do_init_module+0x7c/0x2a4
init_module_from_file+0xb4/0x108 idempotent_init_module+0x184/0x34c
sys_finit_module+0x90/0x114 And oopses are possible when lockdep is enabled
or the RTAS tracepoints are active, since those paths dereference the
result of the lookup. Use the correct spelling to match firmware’s
behavior, adjusting the related constants to match.

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

Related for UB:CVE-2024-26847