VYPR
← All advisories
High severity7.8NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-47730

CVE-2024-47730

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: hisilicon/qm - inject error before stopping queue

The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free in the Linux kernel's hisilicon/qm crypto driver due to injecting QM error after stopping queue; fix inverts the order.

Vulnerability

Description

CVE-2024-47730 is a use-after-free vulnerability in the Linux kernel's crypto subsystem, specifically in the hisilicon/qm driver. The root cause is the incorrect ordering of operations when handling a memory error reported by the accelerator core. To properly close the master ooo (out-of-order) engine, the driver must inject a QM error. However, the code performed the queue stop before injecting the error, creating a window where memory can be freed and then accessed by the device [1][2].

Exploitation

Context

An attacker with the ability to trigger a memory error in the accelerator core can exploit this race condition. The vulnerability does not require network access but does require local access to the hardware accelerator. When the queue is stopped, the driver may release memory immediately. If the QM error injection then occurs, the device may attempt to access these already-released memory regions, leading to a use-after-free condition. No special authentication is needed beyond the ability to drive the accelerator.

Impact

If successfully exploited, this flaw could allow an attacker to cause a denial of service (system crash) or potentially achieve arbitrary code execution in the kernel context. The CVSS v3 score of 7.8 (High) reflects the possibility of high impact on confidentiality, integrity, and availability, given local access and low complexity.

Mitigation

The fix, committed in multiple stable kernel branches, swaps the order: QM error is now injected *before* stopping the queue, ensuring the device does not access released memory [1][3][4]. Users should update to kernels containing this patch.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

106

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.