CVE-2024-53153
published 2024-12-24CVE-2024-53153: In the Linux kernel, the following vulnerability has been resolved: PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() Currently, the…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.28%
20.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()
Currently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF
deinit notify function pci_epc_deinit_notify() are called during the
execution of qcom_pcie_perst_assert() i.e., when the host has asserted
PERST#. But quickly after this step, refclk will also be disabled by the
host.
All of the Qcom endpoint SoCs supported as of now depend on the refclk from
the host for keeping the controller operational. Due to this limitation,
any access to the hardware registers in the absence of refclk will result
in a whole endpoint crash. Unfortunately, most of the controller cleanups
require accessing the hardware registers (like eDMA cleanup performed in
dw_pcie_ep_cleanup(), powering down MHI EPF etc...). So these cleanup
functions are currently causing the crash in the endpoint SoC once host
asserts PERST#.
One way to address this issue is by generating the refclk in the endpoint
itself and not depending on the host. But that is not always possible as
some of the endpoint designs do require the endpoint to consume refclk from
the host (as I was told by the Qcom engineers).
Thus, fix this crash by moving the controller cleanups to the start of
the qcom_pcie_perst_deassert() function. qcom_pcie_perst_deassert() is
called whenever the host has deasserted PERST# and it is guaranteed that
the refclk would be active at this point. So at the start of this function
(after enabling resources), the controller cleanup can be performed. Once
finished, rest of the code execution for PERST# deassert can continue as
usual.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.12.3-1 (forky) | linux 6.12.3-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 570d7715eed8a29ac5bd96c7694f060a991e5a31 < e03b5f1615c84f4139cb53ef8659f4cdb8d6a563 | e03b5f1615c84f4139cb53ef8659f4cdb8d6a563 |
| linux | linux | >= 570d7715eed8a29ac5bd96c7694f060a991e5a31 < 516969d5765e2302d33b4f251496eedb757d55ea | 516969d5765e2302d33b4f251496eedb757d55ea |
| linux | linux | >= 570d7715eed8a29ac5bd96c7694f060a991e5a31 < 7d7cf89b119af433354f865fc01017b9f8aa411a | 7d7cf89b119af433354f865fc01017b9f8aa411a |
| linux | linux_kernel | >= 0 < 6.12.3-1 | 6.12.3-1 |
| linux | linux_kernel | >= 0 < 6.12.3-1 | 6.12.3-1 |
| linux | linux_kernel | >= 0 < 6.11.0-18.18 | 6.11.0-18.18 |
| linux | linux_kernel | >= 6.10 < 6.11.11 | 6.11.11 |
| linux | linux_kernel | >= 6.12 < 6.12.2 | 6.12.2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-02-28
CVE-2024-47738 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Attila Szász discovered that the HFS+ file system implementation in the
Linux Kernel contained a heap overflow vulnerability. An attacker could use
a specially crafted file system image that, when mounted, could cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2025-0927)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- SuperH RISC architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
-
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-02-19
CVE-2024-47738 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- SuperH RISC architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- ATA over ethernet (AOE) driver;
- RAM backed block device driver;
- Network block device driver;
- Ublk userspace block driver;
- Compressed RAM block device driver;
- Bluetooth drivers;
- TPM device driver;
- Clock fr
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-02-19
CVE-2024-49996 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Attila Szász discovered that the HFS+ file system implementation in the
Linux Kernel contained a heap overflow vulnerability. An attacker could use
a specially crafted file system image that, when mounted, could cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2025-0927)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- SuperH RISC architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
-
Red Hat
kernel: PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()
vendor_redhat·2024-12-24·CVSS 5.5
CVE-2024-53153 [MEDIUM] kernel: PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()
kernel: PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()
In the Linux kernel, the following vulnerability has been resolved:
PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()
Currently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF
deinit notify function pci_epc_deinit_notify() are called during the
execution of qcom_pcie_perst_assert() i.e., when the host has asserted
PERST#. But quickly after this step, refclk will also be disabled by the
host.
All of the Qcom endpoint SoCs supported as of now depend on the refclk from
the host for keeping the controller operational. Due to this limitation,
any access to the hardware registers in the absence of refclk will result
in a whole endpoint crash. Unfortunately, most of the controller cleanups
Debian
CVE-2024-53153: linux - In the Linux kernel, the following vulnerability has been resolved: PCI: qcom-e...
vendor_debian·2024·CVSS 5.5
CVE-2024-53153 [MEDIUM] CVE-2024-53153: linux - In the Linux kernel, the following vulnerability has been resolved: PCI: qcom-e...
In the Linux kernel, the following vulnerability has been resolved: PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() Currently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF deinit notify function pci_epc_deinit_notify() are called during the execution of qcom_pcie_perst_assert() i.e., when the host has asserted PERST#. But quickly after this step, refclk will also be disabled by the host. All of the Qcom endpoint SoCs supported as of now depend on the refclk from the host for keeping the controller operational. Due to this limitation, any access to the hardware registers in the absence of refclk will result in a whole endpoint crash. Unfortunately, most of the controller cleanups require accessing the hardware registers (like eDMA cleanup performed in dw_p
OSV
linux-oem-6.11 vulnerabilities
osv·2025-02-28
CVE-2025-0927 linux-oem-6.11 vulnerabilities
linux-oem-6.11 vulnerabilities
Attila Szász discovered that the HFS+ file system implementation in the
Linux Kernel contained a heap overflow vulnerability. An attacker could use
a specially crafted file system image that, when mounted, could cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2025-0927)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- SuperH RISC architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
-
OSV
linux-aws, linux-azure, linux-gcp, linux-oracle, linux-raspi, linux-realtime vulnerabilities
osv·2025-02-19
linux-aws, linux-azure, linux-gcp, linux-oracle, linux-raspi, linux-realtime vulnerabilities
linux-aws, linux-azure, linux-gcp, linux-oracle, linux-raspi, linux-realtime vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- SuperH RISC architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- ATA over ethernet (AOE) driver;
- RAM backed block device driver;
- Network block device driver;
- Ublk userspace block driver;
- Compressed RAM block device driver;
- Bluetooth drivers;
- TPM device driver;
- Clock framework a
OSV
linux, linux-lowlatency vulnerabilities
osv·2025-02-19
CVE-2025-0927 linux, linux-lowlatency vulnerabilities
linux, linux-lowlatency vulnerabilities
Attila Szász discovered that the HFS+ file system implementation in the
Linux Kernel contained a heap overflow vulnerability. An attacker could use
a specially crafted file system image that, when mounted, could cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2025-0927)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- SuperH RISC architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI d
GHSA
GHSA-4xvw-5j63-2hjx: In the Linux kernel, the following vulnerability has been resolved:
PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()
Currently,
ghsa_unreviewed·2024-12-24
CVE-2024-53153 [MEDIUM] GHSA-4xvw-5j63-2hjx: In the Linux kernel, the following vulnerability has been resolved:
PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()
Currently,
In the Linux kernel, the following vulnerability has been resolved:
PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()
Currently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF
deinit notify function pci_epc_deinit_notify() are called during the
execution of qcom_pcie_perst_assert() i.e., when the host has asserted
PERST#. But quickly after this step, refclk will also be disabled by the
host.
All of the Qcom endpoint SoCs supported as of now depend on the refclk from
the host for keeping the controller operational. Due to this limitation,
any access to the hardware registers in the absence of refclk will result
in a whole endpoint crash. Unfortunately, most of the controller cleanups
require accessing the hardware registers (like eDMA cleanup performed in
d
OSV
CVE-2024-53153: In the Linux kernel, the following vulnerability has been resolved: PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() Currently, th
osv·2024-12-24·CVSS 5.5
CVE-2024-53153 [MEDIUM] CVE-2024-53153: In the Linux kernel, the following vulnerability has been resolved: PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() Currently, th
In the Linux kernel, the following vulnerability has been resolved: PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() Currently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF deinit notify function pci_epc_deinit_notify() are called during the execution of qcom_pcie_perst_assert() i.e., when the host has asserted PERST#. But quickly after this step, refclk will also be disabled by the host. All of the Qcom endpoint SoCs supported as of now depend on the refclk from the host for keeping the controller operational. Due to this limitation, any access to the hardware registers in the absence of refclk will result in a whole endpoint crash. Unfortunately, most of the controller cleanups require accessing the hardware registers (like eDMA cleanup performed in dw_p
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-12-24
Published