{
  "threat_severity" : "Moderate",
  "public_date" : "2024-09-27T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: iommufd: Require drivers to supply the cache_invalidate_user ops",
    "id" : "2315176",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2315176"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-476",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\niommufd: Require drivers to supply the cache_invalidate_user ops\nIf drivers don't do this then iommufd will oops invalidation ioctls with\nsomething like:\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000000\nMem abort info:\nESR = 0x0000000086000004\nEC = 0x21: IABT (current EL), IL = 32 bits\nSET = 0, FnV = 0\nEA = 0, S1PTW = 0\nFSC = 0x04: level 0 translation fault\nuser pgtable: 4k pages, 48-bit VAs, pgdp=0000000101059000\n[0000000000000000] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000086000004 [#1] PREEMPT SMP\nModules linked in:\nCPU: 2 PID: 371 Comm: qemu-system-aar Not tainted 6.8.0-rc7-gde77230ac23a #9\nHardware name: linux,dummy-virt (DT)\npstate: 81400809 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=-c)\npc : 0x0\nlr : iommufd_hwpt_invalidate+0xa4/0x204\nsp : ffff800080f3bcc0\nx29: ffff800080f3bcf0 x28: ffff0000c369b300 x27: 0000000000000000\nx26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000\nx23: 0000000000000000 x22: 00000000c1e334a0 x21: ffff0000c1e334a0\nx20: ffff800080f3bd38 x19: ffff800080f3bd58 x18: 0000000000000000\nx17: 0000000000000000 x16: 0000000000000000 x15: 0000ffff8240d6d8\nx14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\nx11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000\nx8 : 0000001000000002 x7 : 0000fffeac1ec950 x6 : 0000000000000000\nx5 : ffff800080f3bd78 x4 : 0000000000000003 x3 : 0000000000000002\nx2 : 0000000000000000 x1 : ffff800080f3bcc8 x0 : ffff0000c6034d80\nCall trace:\n0x0\niommufd_fops_ioctl+0x154/0x274\n__arm64_sys_ioctl+0xac/0xf0\ninvoke_syscall+0x48/0x110\nel0_svc_common.constprop.0+0x40/0xe0\ndo_el0_svc+0x1c/0x28\nel0_svc+0x34/0xb4\nel0t_64_sync_handler+0x120/0x12c\nel0t_64_sync+0x190/0x194\nAll existing drivers implement this op for nesting, this is mostly a\nbisection aid." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-11-14T00:00:00Z",
    "advisory" : "RHSA-2024:9605",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-503.14.1.el9_5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-11-14T00:00:00Z",
    "advisory" : "RHSA-2024:9605",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-503.14.1.el9_5"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-46824\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-46824\nhttps://lore.kernel.org/linux-cve-announce/2024092750-CVE-2024-46824-03d9@gregkh/T" ],
  "name" : "CVE-2024-46824",
  "csaw" : false
}