CVE-2024-42264 (GCVE-0-2024-42264)
Vulnerability from cvelistv5
Published
2024-08-17 08:54
Modified
2026-08-05 11:36
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage where the ids will be copied into. (cherry picked from commit f32b5128d2c440368b5bf3a7a356823e235caabb)
References
Impacted products
Vendor Product Version
Linux Linux Version: bae7cb5d68001a8d4ceec5964dda74bb9aab7220
Version: bae7cb5d68001a8d4ceec5964dda74bb9aab7220
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42264",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:12:34.023274Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:32.942Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "73ad583bd4938bf37d2709fc36901eb6f22f2722",
              "status": "affected",
              "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220",
              "versionType": "git"
            },
            {
              "lessThan": "6ce9efd12ae81cf46bf44eb0348594558dfbb9d2",
              "status": "affected",
              "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Prevent out of bounds access in performance query extensions\n\nCheck that the number of perfmons userspace is passing in the copy and\nreset extensions is not greater than the internal kernel storage where\nthe ids will be copied into.\n\n(cherry picked from commit f32b5128d2c440368b5bf3a7a356823e235caabb)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached only through the DRM_IOCTL_V3D_SUBMIT_CPU ioctl on the local v3d render node (/dev/dri/renderD128); there is no remote or adjacent-network path to this code.\nAC:L - A single ioctl with an oversized nperfmons deterministically performs the out-of-bounds write, with the attacker choosing the allocation size, overflow length and every written dword; no race, timing window, or uncontrollable state is involved.\nPR:L - Only an open file descriptor on the GPU render node is needed \u2014 DRM_AUTH is bypassed for render clients (drm_ioctl.c:606) and no capability check exists on the path, so any local user with normal graphics access (including sandboxed GPU/container processes) qualifies.\nUI:N - The attacker triggers the bug entirely from their own process via a single ioctl; no victim action or interaction is required.\nS:U - The corruption occurs in kernel heap memory within the same security authority; this is standard local kernel privilege escalation with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The controlled heap overflow can overwrite adjacent slab objects and the in-struct drm_syncobj pointer, which is later dereferenced \u2014 yielding pointer-corruption primitives readily leveraged for arbitrary kernel memory disclosure.\nI:H - This is an unbounded out-of-bounds write where both the length and every written 32-bit value are fully attacker-controlled, and the overwritten syncobj pointer is subsequently dereferenced and refcount-decremented \u2014 a direct route to arbitrary kernel memory corruption and control-flow hijack.\nA:H - Writing past the kvmalloc\u0027d queries buffer corrupts slab metadata and adjacent objects and dereferences an attacker-supplied pointer, reliably producing an oops or kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:09.987Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/73ad583bd4938bf37d2709fc36901eb6f22f2722"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ce9efd12ae81cf46bf44eb0348594558dfbb9d2"
        }
      ],
      "title": "drm/v3d: Prevent out of bounds access in performance query extensions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42264",
    "datePublished": "2024-08-17T08:54:20.908Z",
    "dateReserved": "2024-07-30T07:40:12.259Z",
    "dateUpdated": "2026-08-05T11:36:09.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42264\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:12:34.023274Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:23.943Z\"}}], \"cna\": {\"title\": \"drm/v3d: Prevent out of bounds access in performance query extensions\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"bae7cb5d68001a8d4ceec5964dda74bb9aab7220\", \"lessThan\": \"73ad583bd4938bf37d2709fc36901eb6f22f2722\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bae7cb5d68001a8d4ceec5964dda74bb9aab7220\", \"lessThan\": \"6ce9efd12ae81cf46bf44eb0348594558dfbb9d2\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/v3d/v3d_submit.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/v3d/v3d_submit.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/73ad583bd4938bf37d2709fc36901eb6f22f2722\"}, {\"url\": \"https://git.kernel.org/stable/c/6ce9efd12ae81cf46bf44eb0348594558dfbb9d2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/v3d: Prevent out of bounds access in performance query extensions\\n\\nCheck that the number of perfmons userspace is passing in the copy and\\nreset extensions is not greater than the internal kernel storage where\\nthe ids will be copied into.\\n\\n(cherry picked from commit f32b5128d2c440368b5bf3a7a356823e235caabb)\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.4\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:25:29.193Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42264\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:25:29.193Z\", \"dateReserved\": \"2024-07-30T07:40:12.259Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T08:54:20.908Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.