LiveActive security incident?Get immediate response
CVE Record

CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac

In the Linux kernel, the following vulnerability has been resolved: Avoid hw_desc array overrun in dw-axi-dmac I have a use case where nr_buffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descs_allocated to be 9. Since axi_desc_put() handles the hw_desc considering the descs_allocated, this scenario would result in a kernel panic (hw_desc array will be overrun). To fix this, the proposal is to add a new member to the axi_dma_desc structure, where we keep the number of allocated hw_descs (axi_desc_alloc()) and use it in axi_desc_put() to handle the hw_desc array correctly. Additionally I propose to remove the axi_chan_start_first_queued() call after completing the transfer, since it was identified that unbalance can occur (started descriptors can be interrupted and transfer ignored due to DMA channel not being enabled).

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in the Linux dw-axi-dmac DMA driver can overrun an internal descriptor array when handling certain multi-buffer, multi-segment transfers, causing a kernel panic. Because exploitation requires local access and an affected driver configuration, exposure is narrower than for a remotely reachable flaw, but disruption could be serious on dependent systems.

Executive priority

Prioritize affected appliances, embedded systems, and servers where DMA failure could interrupt critical operations. Patch promptly through supported vendor channels, while confirming actual driver use to avoid treating every Linux host as equally exposed.

Technical view

The driver tracked allocated descriptors using a count that could exceed the actual hw_desc array allocation. axi_desc_put() could consequently access beyond that array. The upstream correction separately records the allocated hardware-descriptor count and uses it during cleanup. It also removes a transfer-completion queue-start call associated with channel-state imbalance and ignored transfers.

Likely exposure

Exposure requires an affected Linux kernel using the dw-axi-dmac driver and transfer patterns involving multiple buffers and segments. The bundle identifies affected releases including 5.12, 5.15.162, 6.1.96, 6.6.36, 6.9.7, and 6.10, but its version formatting is insufficient to infer complete ranges safely.

Exploitation context

The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. The documented outcome is a kernel panic from an array overrun. KEV is false, and the supplied sources do not establish active exploitation or a publicly weaponized exploit.

Researcher notes

The supplied description demonstrates an out-of-bounds array access and kernel panic under a specific descriptor layout. Although CVSS scores confidentiality, integrity, and availability impacts as high, the bundle does not document practical privilege escalation, data disclosure, or exploitation beyond the crash condition. Complete affected-version boundaries require vendor confirmation.

Mitigation direction

  • Identify systems using the dw-axi-dmac driver on potentially affected kernels.
  • Apply a vendor-supported kernel update containing the applicable stable correction.
  • Check distribution or appliance guidance for exact fixed package versions.
  • Restrict untrusted local access until affected systems are updated.
  • Test DMA-dependent workloads before broad production rollout.

Validation and detection

  • Record each system's exact kernel build, hardware, and dw-axi-dmac usage.
  • Compare vendor package provenance with the cited stable correction commits.
  • Confirm the updated source tracks allocated hardware descriptors separately.
  • Exercise representative multi-buffer DMA workloads in a controlled environment.
  • Review kernel logs for DMA faults or panics; absence alone does not prove safety.
Prepared
Confidence
high
Sources
8

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-40970 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-40970Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxef6fb2d6f1abd56cc067c694253ea362159b5ac3, ef6fb2d6f1abd56cc067c694253ea362159b5ac3, ef6fb2d6f1abd56cc067c694253ea362159b5ac3, ef6fb2d6f1abd56cc067c694253ea362159b5ac3, ef6fb2d6f1abd56cc067c694253ea362159b5ac3unaffected
LinuxLinux5.12, 0, 5.15.162, 6.1.96, 6.6.36, 6.9.7, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.