CVE-2024-43877
Description
In the event of DMA failure, Linux kernel did not check DMA map result, which could later lead to an out-of-bounds access error.
Statement
A moderate-impact flaw was found in the Linux kernel's ivtv driver for PCI TV capture cards. When a DMA mapping operation fails, the resulting scatter-gather length (dma->SG_length) of 0 is not validated; that value is later used to index dma->SGarray[dma->SG_length - 1], causing an out-of-bounds kernel memory access. Triggering the issue requires local access with high privileges on a system using ivtv hardware together with a DMA mapping failure, and the practical consequence is a system crash or denial of service. Red Hat therefore rated this flaw Moderate (CVSS 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), lower than the NIST (7.1) and CVE.org (7.8) scores, which assume lower privileges and confidentiality or integrity impact that Red Hat does not consider realistic for this constrained error path. The vulnerable code was introduced upstream in Linux kernel 5.16, and all Red Hat Enterprise Linux 6, 7, 8, and 9 kernel streams are recorded as not affected because the kernel versions they are based on predate that introducing change. The Fedora kernel is affected, and a fix is being pursued through the community kernel maintenance process (DELEGATED).
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a kernel version that contains the upstream fix is the recommended resolution; the fix is included in upstream kernel versions 6.1.103, 6.6.44, 6.10.3, and 6.11-rc1 and later.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.4 | 7.1 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | High | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | High | High |
| Integrity Impact | None | None | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
