CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac
In the Linux kernel, the following vulnerability has been resolved:
Avoid hw_desc array overrun in dw-axi-dmac
I have a use case where nr_buffers = 3 and in which each descriptor is composed by 3
segments, resulting in the DMA channel descs_allocated to be 9. Since axi_desc_put()
handles the hw_desc considering the descs_allocated, this scenario would result in a
kernel panic (hw_desc array will be overrun).
To fix this, the proposal is to add a new member to the axi_dma_desc structure,
where we keep the number of allocated hw_descs (axi_desc_alloc()) and use it in
axi_desc_put() to handle the hw_desc array correctly.
Additionally I propose to remove the axi_chan_start_first_queued() call after completing
the transfer, since it was identified that unbalance can occur (started descriptors can
be interrupted and transfer ignored due to DMA channel not being enabled).
Security readout for executives and security teams
Plain-English summary
A flaw in the Linux dw-axi-dmac DMA driver can overrun an internal descriptor array when handling certain multi-buffer, multi-segment transfers, causing a kernel panic. Because exploitation requires local access and an affected driver configuration, exposure is narrower than for a remotely reachable flaw, but disruption could be serious on dependent systems.
Executive priority
Prioritize affected appliances, embedded systems, and servers where DMA failure could interrupt critical operations. Patch promptly through supported vendor channels, while confirming actual driver use to avoid treating every Linux host as equally exposed.
Technical view
The driver tracked allocated descriptors using a count that could exceed the actual hw_desc array allocation. axi_desc_put() could consequently access beyond that array. The upstream correction separately records the allocated hardware-descriptor count and uses it during cleanup. It also removes a transfer-completion queue-start call associated with channel-state imbalance and ignored transfers.
Likely exposure
Exposure requires an affected Linux kernel using the dw-axi-dmac driver and transfer patterns involving multiple buffers and segments. The bundle identifies affected releases including 5.12, 5.15.162, 6.1.96, 6.6.36, 6.9.7, and 6.10, but its version formatting is insufficient to infer complete ranges safely.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. The documented outcome is a kernel panic from an array overrun. KEV is false, and the supplied sources do not establish active exploitation or a publicly weaponized exploit.
Researcher notes
The supplied description demonstrates an out-of-bounds array access and kernel panic under a specific descriptor layout. Although CVSS scores confidentiality, integrity, and availability impacts as high, the bundle does not document practical privilege escalation, data disclosure, or exploitation beyond the crash condition. Complete affected-version boundaries require vendor confirmation.
Mitigation direction
Identify systems using the dw-axi-dmac driver on potentially affected kernels.
Apply a vendor-supported kernel update containing the applicable stable correction.
Check distribution or appliance guidance for exact fixed package versions.
Restrict untrusted local access until affected systems are updated.
Test DMA-dependent workloads before broad production rollout.
Validation and detection
Record each system's exact kernel build, hardware, and dw-axi-dmac usage.
Compare vendor package provenance with the cited stable correction commits.
Confirm the updated source tracks allocated hardware descriptors separately.
Exercise representative multi-buffer DMA workloads in a controlled environment.
Review kernel logs for DMA faults or panics; absence alone does not prove safety.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-40970 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.