Researchers have identified a flaw in the Linux kernel’s dmam_free_coherent() function, rooted in a race condition due to improper sequencing of DMA (Direct Memory Access) resource management operations.
This flaw can cause system instability and malfunctions since DMA is essential for allowing hardware devices to transfer data directly to and from memory without CPU intervention. Exploiting this flaw usually involves manipulating the timing of operations to trigger the race condition.
The dmam_free_coherent() function is designed to deallocate DMA memory and clean up the associated tracking structures. If an attacker can time their actions to coincide with the freeing and reallocation of this memory, they might exploit the race condition.
In such a case, the devres_destroy function could incorrectly remove an entry from the tracking list, leading to a potential warning from the dmam_match function, which is part of the DMA management subsystem in the Linux kernel. The issue arises when two entries with the same virtual address exist in the devres list simultaneously, causing devres_destroy() to mistakenly free the wrong entry.
The report details that dmam_free_coherent() first releases the DMA allocation, making the virtual address available for reuse, and then calls devres_destroy() to clean up the tracking data structure. During the gap between these calls, another task might allocate memory with the same virtual address and add it to the devres list, causing conflicts.
The Patch – CVE-2024-43856
To address this issue, Greg Kroah-Hartman has committed a patch to the Linux kernel, designated CVE-2024-43856. This patch, authored by Lance Richardson from Google, revises the dmam_free_coherent function to correct the race condition by altering the order of operations. Specifically, it ensures that devres_destroy is called to remove the tracking structure before freeing the DMA allocation with dma_free_coherent. This modification prevents concurrent tasks from disrupting the cleanup process.
The patch has been tested on Google’s internal “kokonut” network encryption project and has received approval from Christoph Hellwig and Sasha Levin, marking it as ready for integration into the mainline Linux kernel.
Although exploiting the dmam_free_coherent() flaw to inject arbitrary data into CPU memory is complex and would require precise conditions and additional vulnerabilities, the patch underscores the developer community’s commitment to maintaining a stable and secure Linux operating system as it evolves and supports diverse devices worldwide.
