Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-40968— MIPS: Octeon: Add PCIe link status check

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 MIPS:Octeon 组件在访问 PCIe 配置空间时，未能检查 PCIe 链路状态，可能导致内核崩溃。

AI Predicted 7.5 Difficulty: Hard EPSS 0.30% · P21

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux e8635b484f644c7873e6091f15330c49396f2cbc< 6bff05aaa32c2f7e1f6e68e890876642159db419 affected
e8635b484f644c7873e6091f15330c49396f2cbc< 64845ac64819683ad5e51b668b2ed56ee3386aee affected
e8635b484f644c7873e6091f15330c49396f2cbc< 6c1b9fe148a4e03bbfa234267ebb89f35285814a affected
e8635b484f644c7873e6091f15330c49396f2cbc< 25998f5613159fe35920dbd484fcac7ea3ad0799 affected
e8635b484f644c7873e6091f15330c49396f2cbc< d996deb80398a90dd3c03590e68dad543da87d62 affected
e8635b484f644c7873e6091f15330c49396f2cbc< 1c33fd17383f48f679186c54df78542106deeaa0 affected
e8635b484f644c7873e6091f15330c49396f2cbc< 38d647d509543e9434b3cc470b914348be271fe9 affected
e8635b484f644c7873e6091f15330c49396f2cbc< 29b83a64df3b42c88c0338696feb6fdcd7f1f3b7 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-40968

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MIPS: Octeon: Add PCIe link status check
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: MIPS: Octeon: Add PCIe link status check The standard PCIe configuration read-write interface is used to access the configuration space of the peripheral PCIe devices of the mips processor after the PCIe link surprise down, it can generate kernel panic caused by "Data bus error". So it is necessary to add PCIe link status check for system protection. When the PCIe link is down or in training, assigning a value of 0 to the configuration address can prevent read-write behavior to the configuration space of peripheral PCIe devices, thereby preventing kernel panic.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 MIPS:Octeon 组件在访问 PCIe 配置空间时，未能检查 PCIe 链路状态，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux e8635b484f644c7873e6091f15330c49396f2cbc ~ 6bff05aaa32c2f7e1f6e68e890876642159db419 -
Linux Linux 2.6.31 -

II. Public POCs for CVE-2024-40968

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-40968

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-40968 (1)

Other References for CVE-2024-40968 (7)

Same Patch Batch · Linux · 2024-07-12 · 122 CVEs total

CVE-2024-40937 9.8 CRITICAL gve: Clear napi->skb before dev_kfree_skb_any()
CVE-2024-40907 9.8 CRITICAL ionic: fix kernel panic in XDP_TX action
CVE-2024-40999 9.8 CRITICAL net: ena: Add validation for completion descriptors consistency
CVE-2024-40923 9.8 CRITICAL vmxnet3: disable rx data ring on dma allocation failure
CVE-2024-40983 9.8 CRITICAL tipc: force a dst refcount before doing decryption
CVE-2024-40910 8.8 HIGH ax25: Fix refcount imbalance on inbound connections
CVE-2024-40911 8.8 HIGH wifi: cfg80211: Lock wiphy in cfg80211_get_station
CVE-2024-40941 8.1 HIGH wifi: iwlwifi: mvm: don't read past the mfuart notifcation
CVE-2024-40953 7.9 HIGH KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
CVE-2024-40947 7.8 HIGH ima: Avoid blocking in RCU read-side critical section
CVE-2024-39495 7.8 HIGH greybus: Fix use-after-free bug in gb_interface_release due to race condition.
CVE-2024-40909 7.8 HIGH bpf: Fix a potential use-after-free in bpf_link_free()
CVE-2024-40949 7.8 HIGH mm: shmem: fix getting incorrect lruvec when replacing a shmem folio
CVE-2024-40991 7.8 HIGH dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()
CVE-2024-40990 7.8 HIGH RDMA/mlx5: Add check for srq max_sge attribute
CVE-2024-40989 7.8 HIGH KVM: arm64: Disassociate vcpus from redistributor region on teardown
CVE-2024-40925 7.8 HIGH block: fix request.queuelist usage in flush
CVE-2024-40984 7.8 HIGH ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
CVE-2024-40924 7.8 HIGH drm/i915/dpt: Make DPT object unshrinkable
CVE-2024-40970 7.8 HIGH Avoid hw_desc array overrun in dw-axi-dmac

Showing top 20 of 122 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-40968

No comments yet

Leave a comment