CVE-2024-35843 (GCVE-0-2024-35843)

Vulnerability from cvelistv5 – Published: 2024-05-17 14:40 – Updated: 2026-05-11 20:12
VLAI
Title
iommu/vt-d: Use device rbtree in iopf reporting path
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Use device rbtree in iopf reporting path The existing I/O page fault handler currently locates the PCI device by calling pci_get_domain_bus_and_slot(). This function searches the list of all PCI devices until the desired device is found. To improve lookup efficiency, replace it with device_rbtree_find() to search the device within the probed device rbtree. The I/O page fault is initiated by the device, which does not have any synchronization mechanism with the software to ensure that the device stays in the probed device tree. Theoretically, a device could be released by the IOMMU subsystem after device_rbtree_find() and before iopf_get_dev_fault_param(), which would cause a use-after-free problem. Add a mutex to synchronize the I/O page fault reporting path and the IOMMU release device path. This lock doesn't introduce any performance overhead, as the conflict between I/O page fault reporting and device releasing is very rare.
Severity
6.8 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 06f4b8d09dbabec631ed7b033f5d5413d86c7134 , < 3d39238991e745c5df85785604f037f35d9d1b15 (git)
Affected: 06f4b8d09dbabec631ed7b033f5d5413d86c7134 , < def054b01a867822254e1dda13d587f5c7a99e2a (git)
Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 6.8.2 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "3d39238991e7",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "def054b01a86",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.8.*",
                "status": "unaffected",
                "version": "6.8.2",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "6.9"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35843",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-04T19:36:46.083168Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T19:36:51.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "ADP Container"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.021Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/dmar.c",
            "drivers/iommu/intel/iommu.c",
            "drivers/iommu/intel/iommu.h",
            "drivers/iommu/intel/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d39238991e745c5df85785604f037f35d9d1b15",
              "status": "affected",
              "version": "06f4b8d09dbabec631ed7b033f5d5413d86c7134",
              "versionType": "git"
            },
            {
              "lessThan": "def054b01a867822254e1dda13d587f5c7a99e2a",
              "status": "affected",
              "version": "06f4b8d09dbabec631ed7b033f5d5413d86c7134",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/dmar.c",
            "drivers/iommu/intel/iommu.c",
            "drivers/iommu/intel/iommu.h",
            "drivers/iommu/intel/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Use device rbtree in iopf reporting path\n\nThe existing I/O page fault handler currently locates the PCI device by\ncalling pci_get_domain_bus_and_slot(). This function searches the list\nof all PCI devices until the desired device is found. To improve lookup\nefficiency, replace it with device_rbtree_find() to search the device\nwithin the probed device rbtree.\n\nThe I/O page fault is initiated by the device, which does not have any\nsynchronization mechanism with the software to ensure that the device\nstays in the probed device tree. Theoretically, a device could be released\nby the IOMMU subsystem after device_rbtree_find() and before\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\n\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\nrelease device path. This lock doesn\u0027t introduce any performance overhead,\nas the conflict between I/O page fault reporting and device releasing is\nvery rare."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:12:12.839Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15"
        },
        {
          "url": "https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a"
        }
      ],
      "title": "iommu/vt-d: Use device rbtree in iopf reporting path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35843",
    "datePublished": "2024-05-17T14:40:10.747Z",
    "dateReserved": "2024-05-17T13:50:33.104Z",
    "dateUpdated": "2026-05-11T20:12:12.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35843",
      "date": "2026-05-27",
      "epss": "0.00016",
      "percentile": "0.03887"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/vt-d: Use device rbtree in iopf reporting path\\n\\nThe existing I/O page fault handler currently locates the PCI device by\\ncalling pci_get_domain_bus_and_slot(). This function searches the list\\nof all PCI devices until the desired device is found. To improve lookup\\nefficiency, replace it with device_rbtree_find() to search the device\\nwithin the probed device rbtree.\\n\\nThe I/O page fault is initiated by the device, which does not have any\\nsynchronization mechanism with the software to ensure that the device\\nstays in the probed device tree. Theoretically, a device could be released\\nby the IOMMU subsystem after device_rbtree_find() and before\\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\\n\\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\\nrelease device path. This lock doesn\u0027t introduce any performance overhead,\\nas the conflict between I/O page fault reporting and device releasing is\\nvery rare.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: iommu/vt-d: use el rbtree del dispositivo en la ruta de informes iopf. El controlador de fallos de la p\\u00e1gina de E/S existente actualmente ubica el dispositivo PCI llamando a pci_get_domain_bus_and_slot(). Esta funci\\u00f3n busca en la lista de todos los dispositivos PCI hasta encontrar el dispositivo deseado. Para mejorar la eficiencia de la b\\u00fasqueda, reempl\\u00e1celo con device_rbtree_find() para buscar el dispositivo dentro del rbtree del dispositivo probado. El fallo de la p\\u00e1gina de E/S la inicia el dispositivo, que no tiene ning\\u00fan mecanismo de sincronizaci\\u00f3n con el software para garantizar que el dispositivo permanezca en el \\u00e1rbol de dispositivos analizados. En teor\\u00eda, el subsistema IOMMU podr\\u00eda liberar un dispositivo despu\\u00e9s de device_rbtree_find() y antes de iopf_get_dev_fault_param(), lo que causar\\u00eda un problema de uso despu\\u00e9s de la liberaci\\u00f3n. Agregue un mutex para sincronizar la ruta de informe de fallos de la p\\u00e1gina de E/S y la ruta del dispositivo de liberaci\\u00f3n IOMMU. Este bloqueo no introduce ninguna sobrecarga de rendimiento, ya que el conflicto entre el informe de fallos de la p\\u00e1gina de E/S y la liberaci\\u00f3n del dispositivo es muy raro.\"}]",
      "id": "CVE-2024-35843",
      "lastModified": "2024-11-21T09:21:01.610",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\", \"baseScore\": 6.8, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.5, \"impactScore\": 4.2}]}",
      "published": "2024-05-17T15:15:21.313",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35843\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T15:15:21.313\",\"lastModified\":\"2025-04-07T19:05:09.400\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/vt-d: Use device rbtree in iopf reporting path\\n\\nThe existing I/O page fault handler currently locates the PCI device by\\ncalling pci_get_domain_bus_and_slot(). This function searches the list\\nof all PCI devices until the desired device is found. To improve lookup\\nefficiency, replace it with device_rbtree_find() to search the device\\nwithin the probed device rbtree.\\n\\nThe I/O page fault is initiated by the device, which does not have any\\nsynchronization mechanism with the software to ensure that the device\\nstays in the probed device tree. Theoretically, a device could be released\\nby the IOMMU subsystem after device_rbtree_find() and before\\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\\n\\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\\nrelease device path. This lock doesn\u0027t introduce any performance overhead,\\nas the conflict between I/O page fault reporting and device releasing is\\nvery rare.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iommu/vt-d: use el rbtree del dispositivo en la ruta de informes iopf. El controlador de fallos de la p\u00e1gina de E/S existente actualmente ubica el dispositivo PCI llamando a pci_get_domain_bus_and_slot(). Esta funci\u00f3n busca en la lista de todos los dispositivos PCI hasta encontrar el dispositivo deseado. Para mejorar la eficiencia de la b\u00fasqueda, reempl\u00e1celo con device_rbtree_find() para buscar el dispositivo dentro del rbtree del dispositivo probado. El fallo de la p\u00e1gina de E/S la inicia el dispositivo, que no tiene ning\u00fan mecanismo de sincronizaci\u00f3n con el software para garantizar que el dispositivo permanezca en el \u00e1rbol de dispositivos analizados. En teor\u00eda, el subsistema IOMMU podr\u00eda liberar un dispositivo despu\u00e9s de device_rbtree_find() y antes de iopf_get_dev_fault_param(), lo que causar\u00eda un problema de uso despu\u00e9s de la liberaci\u00f3n. Agregue un mutex para sincronizar la ruta de informe de fallos de la p\u00e1gina de E/S y la ruta del dispositivo de liberaci\u00f3n IOMMU. Este bloqueo no introduce ninguna sobrecarga de rendimiento, ya que el conflicto entre el informe de fallos de la p\u00e1gina de E/S y la liberaci\u00f3n del dispositivo es muy raro.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.8.2\",\"matchCriteriaId\":\"6402FBC3-9412-48E2-992D-DA529B4CF698\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:49.021Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35843\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-04T19:36:46.083168Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"3d39238991e7\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"def054b01a86\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.8.2\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.8.*\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.9\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-17T17:52:10.902Z\"}}], \"cna\": {\"title\": \"iommu/vt-d: Use device rbtree in iopf reporting path\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"06f4b8d09dbabec631ed7b033f5d5413d86c7134\", \"lessThan\": \"3d39238991e745c5df85785604f037f35d9d1b15\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"06f4b8d09dbabec631ed7b033f5d5413d86c7134\", \"lessThan\": \"def054b01a867822254e1dda13d587f5c7a99e2a\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/iommu/intel/dmar.c\", \"drivers/iommu/intel/iommu.c\", \"drivers/iommu/intel/iommu.h\", \"drivers/iommu/intel/svm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.1\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.8.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/iommu/intel/dmar.c\", \"drivers/iommu/intel/iommu.c\", \"drivers/iommu/intel/iommu.h\", \"drivers/iommu/intel/svm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15\"}, {\"url\": \"https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/vt-d: Use device rbtree in iopf reporting path\\n\\nThe existing I/O page fault handler currently locates the PCI device by\\ncalling pci_get_domain_bus_and_slot(). This function searches the list\\nof all PCI devices until the desired device is found. To improve lookup\\nefficiency, replace it with device_rbtree_find() to search the device\\nwithin the probed device rbtree.\\n\\nThe I/O page fault is initiated by the device, which does not have any\\nsynchronization mechanism with the software to ensure that the device\\nstays in the probed device tree. Theoretically, a device could be released\\nby the IOMMU subsystem after device_rbtree_find() and before\\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\\n\\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\\nrelease device path. This lock doesn\u0027t introduce any performance overhead,\\nas the conflict between I/O page fault reporting and device releasing is\\nvery rare.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.2\", \"versionStartIncluding\": \"6.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.1\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:35:23.489Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35843\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:35:23.489Z\", \"dateReserved\": \"2024-05-17T13:50:33.104Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T14:40:10.747Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.