CVE-2024-38581 (GCVE-0-2024-38581)
Vulnerability from cvelistv5
Published
2024-06-19 13:37
Modified
2026-08-05 11:32
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: fix use-after-free issue Delete fence fallback timer to fix the ramdom use-after-free issue. v2: move to amdgpu_mes.c
References
Impacted products
Vendor Product Version
Linux Linux Version: 8c5e13ec6a2c26d31d0551dc382661dc10823be0
Version: 8c5e13ec6a2c26d31d0551dc382661dc10823be0
Version: 8c5e13ec6a2c26d31d0551dc382661dc10823be0
Version: 8c5e13ec6a2c26d31d0551dc382661dc10823be0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38581",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-20T14:58:15.450879Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T14:58:23.883Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.835Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/70b1bf6d9edc8692d241f59a65f073aec6d501de"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/39cfce75168c11421d70b8c0c65f6133edccb82a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0f98c144c15c8fc0f3176c994bd4e727ef718a5c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/948255282074d9367e01908b3f5dcf8c10fc9c3d"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "70b1bf6d9edc8692d241f59a65f073aec6d501de",
              "status": "affected",
              "version": "8c5e13ec6a2c26d31d0551dc382661dc10823be0",
              "versionType": "git"
            },
            {
              "lessThan": "39cfce75168c11421d70b8c0c65f6133edccb82a",
              "status": "affected",
              "version": "8c5e13ec6a2c26d31d0551dc382661dc10823be0",
              "versionType": "git"
            },
            {
              "lessThan": "0f98c144c15c8fc0f3176c994bd4e727ef718a5c",
              "status": "affected",
              "version": "8c5e13ec6a2c26d31d0551dc382661dc10823be0",
              "versionType": "git"
            },
            {
              "lessThan": "948255282074d9367e01908b3f5dcf8c10fc9c3d",
              "status": "affected",
              "version": "8c5e13ec6a2c26d31d0551dc382661dc10823be0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/mes: fix use-after-free issue\n\nDelete fence fallback timer to fix the ramdom\nuse-after-free issue.\n\nv2: move to amdgpu_mes.c"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path lives in the amdgpu GPU driver and is reached through local device access \u2014 opening/ioctl\u0027ing /dev/dri/renderD* triggers pm_runtime_get_sync(), and the resulting runtime-PM resume runs amdgpu_mes_self_test(). There is no network-facing component.\nAC:L - The attacker drives both sides of the timer-versus-free race: they trigger the MES self-test arbitrarily often via runtime PM cycles, and they control GPU load so the IB test times out \u2014 the path on which the fallback timer is left deterministically armed across kfree(ring). Repeated attempts are free and unlimited.\nPR:L - A basic unprivileged local user with access to the DRM render node (default on desktop/laptop distros via the render group or logind ACLs) can open the device and force runtime suspend/resume cycles; no capabilities or root are needed.\nUI:N - The attacker self-triggers the runtime-PM resume that runs the self-test through its own open()/ioctl() calls; no victim action such as a manual suspend or file open is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed struct amdgpu_ring comes from a generic kmalloc cache reclaimable by attacker-sprayed data, and the timer callback dereferences ring-\u003eadev, ring-\u003efence_drv.fences[] and fence-\u003eops from it, allowing attacker-directed reads of arbitrary kernel memory.\nI:H - The callback performs atomic_cmpxchg() and RCU_INIT_POINTER() writes into the freed object and makes indirect calls through fence-\u003eops read out of reclaimed memory, yielding write and control-flow-hijack primitives; freeing an armed timer_list also corrupts the timer base list.\nA:H - Even unweaponized, the fallback timer firing on freed memory produces a use-after-free oops/panic or timer-list corruption, and it can be re-triggered on every resume cycle."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:57.888Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/70b1bf6d9edc8692d241f59a65f073aec6d501de"
        },
        {
          "url": "https://git.kernel.org/stable/c/39cfce75168c11421d70b8c0c65f6133edccb82a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f98c144c15c8fc0f3176c994bd4e727ef718a5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/948255282074d9367e01908b3f5dcf8c10fc9c3d"
        }
      ],
      "title": "drm/amdgpu/mes: fix use-after-free issue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38581",
    "datePublished": "2024-06-19T13:37:38.509Z",
    "dateReserved": "2024-06-18T19:36:34.927Z",
    "dateUpdated": "2026-08-05T11:32:57.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/70b1bf6d9edc8692d241f59a65f073aec6d501de\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/39cfce75168c11421d70b8c0c65f6133edccb82a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0f98c144c15c8fc0f3176c994bd4e727ef718a5c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/948255282074d9367e01908b3f5dcf8c10fc9c3d\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:12:25.835Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38581\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-20T14:58:15.450879Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-20T14:58:20.702Z\"}}], \"cna\": {\"title\": \"drm/amdgpu/mes: fix use-after-free issue\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8c5e13ec6a2c26d31d0551dc382661dc10823be0\", \"lessThan\": \"70b1bf6d9edc8692d241f59a65f073aec6d501de\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8c5e13ec6a2c26d31d0551dc382661dc10823be0\", \"lessThan\": \"39cfce75168c11421d70b8c0c65f6133edccb82a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8c5e13ec6a2c26d31d0551dc382661dc10823be0\", \"lessThan\": \"0f98c144c15c8fc0f3176c994bd4e727ef718a5c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8c5e13ec6a2c26d31d0551dc382661dc10823be0\", \"lessThan\": \"948255282074d9367e01908b3f5dcf8c10fc9c3d\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/70b1bf6d9edc8692d241f59a65f073aec6d501de\"}, {\"url\": \"https://git.kernel.org/stable/c/39cfce75168c11421d70b8c0c65f6133edccb82a\"}, {\"url\": \"https://git.kernel.org/stable/c/0f98c144c15c8fc0f3176c994bd4e727ef718a5c\"}, {\"url\": \"https://git.kernel.org/stable/c/948255282074d9367e01908b3f5dcf8c10fc9c3d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu/mes: fix use-after-free issue\\n\\nDelete fence fallback timer to fix the ramdom\\nuse-after-free issue.\\n\\nv2: move to amdgpu_mes.c\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"4.20\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:19:29.511Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38581\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:19:29.511Z\", \"dateReserved\": \"2024-06-18T19:36:34.927Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:37:38.509Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.