CVE-2024-27408

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable sequence is reached only through the local dmaengine client API (`dma_async_issue_pending()` → `dw_edma_device_issue_pending()` → `dw_edma_v0_core_start()`), i.e. via a device node or in-kernel client on the host driving the remote eDMA. There is no network- or packet-facing path into drivers/dma/dw-edma/.

AC:LAttack complexity, low

An attacker able to submit transfers can repeat them indefinitely at no cost and can widen the window at will by building large scatter-gather lists, since every chunk re-writes the LL and rings the doorbell again — and per the commit, on affected remote setups the unordered doorbell simply races the LL writes rather than requiring an unusual condition.

PR:LPrivileges required, low

No capability check exists on the path — the dmaengine core imposes none, so an unprivileged local account with ordinary access to a client device node backed by these eDMA channels is sufficient to issue the transfers that ring the doorbell.

UI:NUser interaction, none

The attacker drives the entire submit/complete cycle on its own; no action by another user or administrator is needed, and an already-bound dw-edma-pcie device is system configuration rather than victim interaction.

S:UScope, unchanged

The corrupted transfers act on host memory already within the DMA mapping the kernel authorized for this device, all under the same kernel security authority; no IOMMU, VM, or sandbox boundary is bypassed.

C:HConfidentiality impact, high

A torn descriptor makes the engine read from the previous chunk's SAR while writing to the new DAR, and a not-yet-landed LLP terminator lets it walk past the LL region and follow arbitrary BAR contents as descriptors, so effectively arbitrary host memory can be sourced and shipped to the remote endpoint or into a buffer the attacker reads back.

I:HIntegrity impact, high

The same stale or run-away descriptors give the PCIe engine a write with attacker-influenceable destination and length into host kernel-mapped memory — a memory-corruption write primitive, not merely wrong data in the intended buffer.

A:HAvailability impact, high

DMA into unintended kernel memory reliably produces corruption and oops/panic, and the malformed descriptor walk also raises linked-list errors and abort interrupts that stall the channel and hang clients waiting on completion.