CVE-2024-26847

5.1 · MEDIUM

Published Apr 17, 2024 linux EPSS 0.24% (15th pctl) CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-26847 is a medium-severity vulnerability affecting linux linux_kernel. It was published on April 17, 2024 and has a CVSS 3.1 base score of 5.1 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.1, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/rtas: use correct function name for resetting TCE tables

The PAPR spec spells the function name as

"ibm,reset-pe-dma-windows"

but in practice firmware uses the singular form:

"ibm,reset-pe-dma-window"

in the device tree. Since we have the wrong spelling in the RTAS

function table, reverse lookups (token -> name) fail and warn:

unexpected failed lookup for token 86

WARNING: CPU: 1 PID: 545 at arch/powerpc/kernel/rtas.c:659 __do_enter_rtas_trace+0x2a4/0x2b4

CPU: 1 PID: 545 Comm: systemd-udevd Not tainted 6.8.0-rc4 #30

Hardware name: IBM,9105-22A POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NL1060_028) hv:phyp pSeries

NIP [c0000000000417f0] __do_enter_rtas_trace+0x2a4/0x2b4

LR [c0000000000417ec] __do_enter_rtas_trace+0x2a0/0x2b4

Call Trace:

__do_enter_rtas_trace+0x2a0/0x2b4 (unreliable)

rtas_call+0x1f8/0x3e0

enable_ddw.constprop.0+0x4d0/0xc84

dma_iommu_dma_supported+0xe8/

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 6.3, < 6.6.21	Affected

References

Ref git.kernel.org/stable/c/6b6282d56b14879124416a23837af9bd52ae2dfb Ref git.kernel.org/stable/c/dd63817baf334888289877ab1db1d866af2a6479 Ref git.kernel.org/stable/c/fad87dbd48156ab940538f052f1820f4b6ed2819 Ref git.kernel.org/stable/c/6b6282d56b14879124416a23837af9bd52ae2dfb Ref git.kernel.org/stable/c/dd63817baf334888289877ab1db1d866af2a6479 Ref git.kernel.org/stable/c/fad87dbd48156ab940538f052f1820f4b6ed2819

Frequently Asked Questions

What is CVE-2024-26847?

CVE-2024-26847 is a medium-severity vulnerability affecting linux linux_kernel. It was published on April 17, 2024 and has a CVSS 3.1 base score of 5.1 (MEDIUM).

How severe is CVE-2024-26847?

This vulnerability has a CVSS 3.1 base score of 5.1, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2024-26847?

How can CyberStrike help with CVE-2024-26847?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-26847 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719