LiveActive security incident?Get immediate response
CVE Record

CVE-2024-47730: crypto: hisilicon/qm - inject error before stopping queue

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - inject error before stopping queue The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory.

HighCVSS 7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux driver flaw affecting certain HiSilicon cryptographic accelerators can let hardware access memory after the driver releases it during memory-error handling. This could expose or corrupt data or crash the system. Exploitation requires local access, privileges, specific hardware and driver use, and difficult timing or conditions.

Executive priority

Treat this as a targeted high-priority kernel update, not an internet-wide emergency. Promptly identify workloads using relevant HiSilicon accelerators, then patch exposed multi-user or untrusted-workload systems first. Current sources do not support emergency action based on active exploitation.

Technical view

The hisilicon/qm driver stopped a queue before injecting the QM error needed to close the master out-of-order engine. Because stopping the queue can immediately release memory, the still-active device may access freed memory. The kernel fix reverses this sequence, injecting the error before stopping the queue.

Likely exposure

Exposure is limited to systems using the affected Linux kernel code with a relevant HiSilicon QM-based accelerator. The listed affected versions span multiple kernel branches, but distribution backports may change status. Systems without the hardware or active driver path are unlikely to be practically exposed.

Exploitation context

The CVSS 3.1 score is 7.0, with local access, low privileges, high complexity, and no user interaction. Potential confidentiality, integrity, and availability impacts are rated high. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit.

Researcher notes

This is an error-path ordering flaw with device access to released memory, resembling a hardware-mediated use-after-free condition; no CWE is supplied. Practical assessment should confirm hardware presence, driver reachability, local privilege requirements, memory-error triggering conditions, and whether downstream kernels backported one of the referenced stable commits.

Mitigation direction

  • Upgrade to a vendor-supported kernel containing the applicable stable fix.
  • Check distribution advisories because patched package versions may differ from upstream kernel versions.
  • Confirm vendor guidance before disabling or changing use of the affected accelerator.
  • Prioritize systems where untrusted local users can access accelerator-backed workloads.

Validation and detection

  • Inventory systems using HiSilicon QM-based cryptographic accelerator hardware and its Linux driver.
  • Record exact kernel and distribution package versions on potentially exposed systems.
  • Verify the installed kernel includes the applicable upstream fix or distribution backport.
  • Confirm the corrected code injects the QM error before stopping the queue.
  • Review relevant kernel and accelerator logs for memory-error or queue-failure events.
Prepared
Confidence
high
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-47730 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7CVSS 3.1HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7High
CVSS 3.1 vector shape for CVE-2024-47730Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6c6dd5802c2d6769fa589c0e8de54299def199a7, 6c6dd5802c2d6769fa589c0e8de54299def199a7, 6c6dd5802c2d6769fa589c0e8de54299def199a7, 6c6dd5802c2d6769fa589c0e8de54299def199a7, 6c6dd5802c2d6769fa589c0e8de54299def199a7, 6c6dd5802c2d6769fa589c0e8de54299def199a7, 6c6dd5802c2d6769fa589c0e8de54299def199a7unaffected
LinuxLinux5.8, 0, 5.10.235, 5.15.174, 6.1.113, 6.6.54, 6.10.13, 6.11.2, 6.12affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.