LiveActive security incident?Get immediate response
CVE Record

CVE-2024-35814: swiotlb: Fix double-allocation of slots due to broken alignment handling

In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fix double-allocation of slots due to broken alignment handling Commit bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix"), which was a fix for commit 0eee5ae10256 ("swiotlb: fix slot alignment checks"), causes a functional regression with vsock in a virtual machine using bouncing via a restricted DMA SWIOTLB pool. When virtio allocates the virtqueues for the vsock device using dma_alloc_coherent(), the SWIOTLB search can return page-unaligned allocations if 'area->index' was left unaligned by a previous allocation from the buffer: # Final address in brackets is the SWIOTLB address returned to the caller | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800) This ends badly (typically buffer corruption and/or a hang) because swiotlb_alloc() is expecting a page-aligned allocation and so blindly returns a pointer to the 'struct page' corresponding to the allocation, therefore double-allocating the first half (2KiB slot) of the 4KiB page. Fix the problem by treating the allocation alignment separately to any additional alignment requirements from the device, using the maximum of the two as the stride to search the buffer slots and taking care to ensure a minimum of page-alignment for buffers larger than a page. This also resolves swiotlb allocation failures occuring due to the inclusion of ~PAGE_MASK in 'iotlb_align_mask' for large allocations and resulting in alignment requirements exceeding swiotlb_max_mapping_size().

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel memory-allocation flaw can assign the same SWIOTLB buffer space twice when alignment is mishandled. In affected virtualized systems, particularly those using restricted DMA bouncing with virtio vsock, this can corrupt memory or hang the system. The supplied CVSS score is 7.8, reflecting potentially severe confidentiality, integrity, and availability impact from local access.

Executive priority

Treat as a high-priority stability and memory-safety issue for exposed virtualized infrastructure, but not as an internet-wide emergency. Quickly identify workloads using the affected DMA path, obtain vendor-confirmed fixed kernels, and schedule remediation according to service criticality. Escalate systems experiencing hangs or corruption.

Technical view

Broken SWIOTLB alignment handling can leave the allocation search index unaligned. For allocations requiring page alignment, the allocator may return a page-unaligned address while treating it as page-aligned, double-allocating part of a page. The documented regression affects restricted DMA SWIOTLB pools and can also cause large-allocation failures when alignment requirements exceed the maximum mapping size.

Likely exposure

Exposure is most likely on affected Linux kernels where devices use SWIOTLB DMA bouncing, especially virtual machines using restricted DMA pools and virtio vsock. The supplied affected-version data lists 6.3 and several releases through 6.9, but its exact range encoding is ambiguous; confirm applicability against vendor advisories and the referenced stable fixes.

Exploitation context

The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. However, the sources document a functional regression, corruption, hangs, and allocation failures—not a demonstrated exploitation method. This CVE is not identified as being in CISA KEV, and the supplied evidence does not establish active exploitation.

Researcher notes

The root issue is an interaction between allocation alignment, device-specific alignment, and the SWIOTLB slot-search stride. The fix separates allocation alignment from device requirements, uses their maximum for searching, and enforces page alignment for buffers larger than a page. The bundle provides multiple stable-tree commits, suggesting branch-specific backports; exact version mapping requires vendor confirmation.

Mitigation direction

  • Update to a vendor-supported Linux kernel containing the applicable referenced stable fix.
  • Prioritize virtual machines using restricted DMA SWIOTLB pools and virtio vsock.
  • Consult the Linux distribution or appliance vendor for precise affected and fixed version boundaries.
  • Apply operational safeguards for affected workloads if immediate kernel replacement is unavailable.

Validation and detection

  • Inventory kernel versions across hosts, guests, appliances, and virtualized workloads.
  • Identify systems using SWIOTLB DMA bouncing, restricted DMA pools, or virtio vsock.
  • Compare deployed kernel sources or vendor packages with the referenced stable fixes.
  • Review system telemetry for unexplained hangs, buffer corruption, or SWIOTLB allocation failures.
  • After updating, confirm the vendor package includes the relevant fix and repeat workload testing.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-1055: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · low confidence lookup

CWE-119: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-35814 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H1.85.2CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-35814Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0eee5ae1025699ea93d44fdb6ef2365505082103, 0eee5ae1025699ea93d44fdb6ef2365505082103, 0eee5ae1025699ea93d44fdb6ef2365505082103, 0eee5ae1025699ea93d44fdb6ef2365505082103unaffected
LinuxLinux6.3, 0, 6.6.24, 6.7.12, 6.8.3, 6.9affected
Weakness

CWE details

CWE-1055CWE-119

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.