CVE-2024-36925

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y

Using restricted DMA pools (CONFIG_DMA_RESTRICTED_POOL=y) in conjunction

with dynamic SWIOTLB (CONFIG_SWIOTLB_DYNAMIC=y) leads to the following

crash when initialising the restricted pools at boot-time:

| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008

| Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP

| pc : rmem_swiotlb_device_init+0xfc/0x1ec

| lr : rmem_swiotlb_device_init+0xf0/0x1ec

| Call trace:

| rmem_swiotlb_device_init+0xfc/0x1ec

| of_reserved_mem_device_init_by_idx+0x18c/0x238

| of_dma_configure_id+0x31c/0x33c

| platform_dma_configure+0x34/0x80

faddr2line reveals that the crash is in the list validation code:

include/linux/list.h:83

include/linux/rculist.h:79

include/linux/rculist.h:106

kernel/dma/swiotlb.c:306

kernel/dma/swiotlb.c:1695

because add_mem_pool() is

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References