LiveActive security incident?Get immediate response
CVE Record

CVE-2024-43877: media: pci: ivtv: Add check for DMA map result

In the Linux kernel, the following vulnerability has been resolved: media: pci: ivtv: Add check for DMA map result In case DMA fails, 'dma->SG_length' is 0. This value is later used to access 'dma->SGarray[dma->SG_length - 1]', which will cause out of bounds access. Add check to return early on invalid value. Adjust warnings accordingly. Found by Linux Verification Center (linuxtesting.org) with SVACE.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A failed DMA mapping in Linux's ivtv media driver can leave a zero-length scatter-gather list. The driver then accesses memory before the list, causing an out-of-bounds kernel access. A local, low-privileged attacker may potentially affect confidentiality, integrity, and availability, but successful exploitation conditions are not established in the supplied sources.

Executive priority

Treat as a high-priority kernel maintenance issue on systems that load ivtv and permit untrusted local access. Exposure elsewhere is likely limited. Patch through supported distribution channels after compatibility testing; escalate immediately if affected media workloads show DMA failures or kernel instability.

Technical view

When DMA mapping fails, SG_length becomes zero. Later code indexes SGarray[SG_length - 1], producing an out-of-bounds access in the ivtv PCI media driver. The kernel fix validates the length and returns early. CVSS 3.1 is 7.8: local access, low complexity, low privileges, no user interaction, and high potential impact.

Likely exposure

Exposure is limited to Linux systems using the affected ivtv driver path, particularly where relevant media hardware is present and DMA mapping can fail. The supplied version data identifies affected branches including 5.16, 6.1.103, 6.6.44, and 6.10.3, but administrators should confirm distribution-specific status.

Exploitation context

The supplied record does not identify active exploitation, and the CVE is not marked as CISA KEV. Its local attack vector and low-privilege requirement reduce remote exposure. Practical exploitability, trigger reliability, and whether the flaw yields more than a kernel crash are not demonstrated by the supplied evidence.

Researcher notes

The defect is an underflowing array index following an unchecked DMA mapping result. SVACE analysis by Linux Verification Center found it. Multiple stable-tree commits are cited, but the supplied bundle does not provide reliable branch-to-commit mapping or evidence of exploitability beyond the CVSS impact assessment.

Mitigation direction

  • Install the distribution-supported kernel update containing the cited ivtv validation fix.
  • Review Linux vendor advisories for the precise fixed package applicable to each deployed distribution.
  • Where operationally acceptable, avoid loading or using ivtv on systems without required compatible hardware.
  • Prioritize multi-user or untrusted-workload systems where local low-privileged access is available.

Validation and detection

  • Inventory kernel versions, distribution package revisions, and systems loading the ivtv module.
  • Confirm installed packages against vendor advisories rather than relying solely on upstream version numbers.
  • Verify the deployed kernel includes an early check for invalid DMA scatter-gather length.
  • After updating, reboot into the corrected kernel and verify the running version.
  • Monitor kernel logs for ivtv DMA failures, warnings, or memory-access faults.
Prepared
Confidence
high
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-43877 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-43877Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4551236b55e80b2c1720b10b77e9400118b2339e, 66c8a83bf1de2eb3eea4734c7eda22255a965f11, 1932dc2f4cf6ac23e48e5fcc24d21adbe35691d1, 1932dc2f4cf6ac23e48e5fcc24d21adbe35691d1, 1932dc2f4cf6ac23e48e5fcc24d21adbe35691d1, 1932dc2f4cf6ac23e48e5fcc24d21adbe35691d1, 1b00b7335000c0e107f774cc8ee4d5340f824f28, 5.4.301unaffected
LinuxLinux5.16, 0, 6.1.103, 6.6.44, 6.10.3, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.