CVE-2024-44976

What it actually does

The pata_macio driver in the Linux kernel can overflow its DMA table when max_segment_size is set to 64KB and a large request causes each SG entry to be split into two commands, triggering a BUG_ON() crash in pata_macio_qc_prep on 32-bit PowerMac systems.

Why it matters to the business

Systems running affected kernel versions on 32-bit PowerMac hardware can experience unexpected kernel crashes and reboots during I/O operations if max_sectors_kb has been increased beyond defaults, leading to downtime and potential loss of in-flight work.

How an attack unfolds

An attacker with local access increases max_sectors_kb via udev or sysfs on an affected 32-bit PowerMac, then issues sufficiently large block I/O requests (for example through filesystem or direct device access) that exceed the DMA table capacity after SG splitting, causing the kernel to hit the BUG_ON and panic.

How to fix it

Upgrade to a fixed kernel containing commit 709e4c8f78e156ab332297bdd87527ec3da4e2d4 or later stable release such as 6.10.7; for 4 KB page kernels revert max_segment_size, and for 64 KB page kernels halve sg_tablesize.

How to confirm the fix worked

Confirm the running kernel contains the referenced fix commit or is at least version 6.10.7, verify that max_segment_size and sg_tablesize match the corrected values for the page size in use, and test large I/O workloads without observing the BUG_ON.

Typical attack path

1. Gain local shell or process execution on target 32-bit PowerMac
2. Modify max_sectors_kb to a value larger than the default 1280
3. Submit large block I/O workloads that trigger SG splitting in pata_macio
4. Trigger the DMA table overflow and BUG_ON in pata_macio_qc_prep

How to detect it

Search kernel logs for BUG messages at drivers/ata/pata_macio.c:544 or oops traces containing pata_macio_qc_prep; review audit logs for changes to /sys/block/*/queue/max_sectors_kb and large bio submissions on PowerMac hardware.

What your security team should do

• Prioritize kernel upgrades on all 32-bit PowerMac systems before adjusting I/O tunables
• Audit udev rules and sysfs settings that raise max_sectors_kb
• Monitor for kernel oops or BUG_ON messages referencing pata_macio_qc_prep
• Apply the fix in the next scheduled maintenance window given the low but non-zero exploitation probability