CVE-2024-46683 (GCVE-0-2024-46683)
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2026-08-05 11:37
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe: prevent UAF around preempt fence The fence lock is part of the queue, therefore in the current design anything locking the fence should then also hold a ref to the queue to prevent the queue from being freed. However, currently it looks like we signal the fence and then drop the queue ref, but if something is waiting on the fence, the waiter is kicked to wake up at some later point, where upon waking up it first grabs the lock before checking the fence state. But if we have already dropped the queue ref, then the lock might already be freed as part of the queue, leading to uaf. To prevent this, move the fence lock into the fence itself so we don't run into lifetime issues. Alternative might be to have device level lock, or only release the queue in the fence release callback, however that might require pushing to another worker to avoid locking issues. References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2454 References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2342 References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2020 (cherry picked from commit 7116c35aacedc38be6d15bd21b2fc936eed0008b)
References
Impacted products
Vendor Product Version
Linux Linux Version: dd08ebf6c3525a7ea2186e636df064ea47281987
Version: dd08ebf6c3525a7ea2186e636df064ea47281987
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46683",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:08:58.866096Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:09:13.919Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_exec_queue.c",
            "drivers/gpu/drm/xe/xe_exec_queue_types.h",
            "drivers/gpu/drm/xe/xe_preempt_fence.c",
            "drivers/gpu/drm/xe/xe_preempt_fence_types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10081b0b0ed201f53e24bd92deb2e0f3c3e713d4",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            },
            {
              "lessThan": "730b72480e29f63fd644f5fa57c9d46109428953",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_exec_queue.c",
            "drivers/gpu/drm/xe/xe_exec_queue_types.h",
            "drivers/gpu/drm/xe/xe_preempt_fence.c",
            "drivers/gpu/drm/xe/xe_preempt_fence_types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.8",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: prevent UAF around preempt fence\n\nThe fence lock is part of the queue, therefore in the current design\nanything locking the fence should then also hold a ref to the queue to\nprevent the queue from being freed.\n\nHowever, currently it looks like we signal the fence and then drop the\nqueue ref, but if something is waiting on the fence, the waiter is\nkicked to wake up at some later point, where upon waking up it first\ngrabs the lock before checking the fence state. But if we have already\ndropped the queue ref, then the lock might already be freed as part of\nthe queue, leading to uaf.\n\nTo prevent this, move the fence lock into the fence itself so we don\u0027t\nrun into lifetime issues. Alternative might be to have device level\nlock, or only release the queue in the fence release callback, however\nthat might require pushing to another worker to avoid locking issues.\n\nReferences: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2454\nReferences: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2342\nReferences: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2020\n(cherry picked from commit 7116c35aacedc38be6d15bd21b2fc936eed0008b)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through xe DRM ioctls (`XE_VM_CREATE`, `XE_EXEC_QUEUE_CREATE`/`_DESTROY`, `XE_VM_BIND`) on a local device node such as /dev/dri/renderD128. No network, adjacent-network, or physical access is involved.\nAC:L - The attacker drives both sides \u2014 triggering preemption/fence signalling and dropping the queue\u0027s last reference via the destroy ioctl \u2014 and can repeat the loop indefinitely. Moreover the stale `fence-\u003elock` pointer persists for as long as the attacker keeps BOs holding BOOKKEEP references to the fence, and `dma_fence_enable_sw_signaling()`/`dma_fence_add_callback()` take that lock unconditionally, so this is a lifetime bug rather than a tight instruction-window race; it was hit three separate times in ordinary CI runs.\nPR:L - Every ioctl on the path is marked `DRM_RENDER_ALLOW`, requiring only an open file descriptor on the render node \u2014 no DRM master, no capability, no root \u2014 which is granted to logged-in desktop users, `render`/`video` group members, GPU-enabled containers, and Android apps. LR-mode VM creation has no additional privilege gate.\nUI:N - A single unprivileged process creates the VM, the exec queue, triggers the rebind/preemption, and destroys the queue entirely on its own. No victim action of any kind is required.\nS:U - The freed object and the corrupted memory both live in the kernel\u0027s own slab allocator, so the impact stays within the kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free that reads the lock word out of a freed `xe_exec_queue` in a generic kmalloc cache the attacker selects via the user-controlled `width` field, allowing the freed slot to be groomed with attacker-chosen or sensitive objects. Per kernel UAF guidance this yields a high-confidence path to kernel memory disclosure.\nI:H - The woken waiter executes `spin_lock_irqsave()` and `spin_unlock_irqrestore()` \u2014 real writes at a fixed offset \u2014 into the freed and potentially reallocated `xe_exec_queue` allocation, corrupting whichever object now occupies that slot. A UAF write into a groomable general-purpose slab cache is the classic starting point for control-flow hijack and privilege escalation.\nA:H - The UAF produces KASAN splats and crashes in practice (three separate freedesktop bug reports), and a stale nonzero value at the lock offset makes the waiter spin forever inside `spin_lock_irqsave()` with interrupts disabled, causing a hard lockup or panic. Any unprivileged user with render-node access can trigger this repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:56.637Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10081b0b0ed201f53e24bd92deb2e0f3c3e713d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/730b72480e29f63fd644f5fa57c9d46109428953"
        }
      ],
      "title": "drm/xe: prevent UAF around preempt fence",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46683",
    "datePublished": "2024-09-13T05:29:15.926Z",
    "dateReserved": "2024-09-11T15:12:18.248Z",
    "dateUpdated": "2026-08-05T11:37:56.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46683\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T15:08:58.866096Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T15:09:03.211Z\"}}], \"cna\": {\"title\": \"drm/xe: prevent UAF around preempt fence\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"dd08ebf6c3525a7ea2186e636df064ea47281987\", \"lessThan\": \"10081b0b0ed201f53e24bd92deb2e0f3c3e713d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dd08ebf6c3525a7ea2186e636df064ea47281987\", \"lessThan\": \"730b72480e29f63fd644f5fa57c9d46109428953\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/xe/xe_exec_queue.c\", \"drivers/gpu/drm/xe/xe_exec_queue_types.h\", \"drivers/gpu/drm/xe/xe_preempt_fence.c\", \"drivers/gpu/drm/xe/xe_preempt_fence_types.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/xe/xe_exec_queue.c\", \"drivers/gpu/drm/xe/xe_exec_queue_types.h\", \"drivers/gpu/drm/xe/xe_preempt_fence.c\", \"drivers/gpu/drm/xe/xe_preempt_fence_types.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/10081b0b0ed201f53e24bd92deb2e0f3c3e713d4\"}, {\"url\": \"https://git.kernel.org/stable/c/730b72480e29f63fd644f5fa57c9d46109428953\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe: prevent UAF around preempt fence\\n\\nThe fence lock is part of the queue, therefore in the current design\\nanything locking the fence should then also hold a ref to the queue to\\nprevent the queue from being freed.\\n\\nHowever, currently it looks like we signal the fence and then drop the\\nqueue ref, but if something is waiting on the fence, the waiter is\\nkicked to wake up at some later point, where upon waking up it first\\ngrabs the lock before checking the fence state. But if we have already\\ndropped the queue ref, then the lock might already be freed as part of\\nthe queue, leading to uaf.\\n\\nTo prevent this, move the fence lock into the fence itself so we don\u0027t\\nrun into lifetime issues. Alternative might be to have device level\\nlock, or only release the queue in the fence release callback, however\\nthat might require pushing to another worker to avoid locking issues.\\n\\nReferences: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2454\\nReferences: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2342\\nReferences: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2020\\n(cherry picked from commit 7116c35aacedc38be6d15bd21b2fc936eed0008b)\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.8\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:34:23.098Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46683\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:34:23.098Z\", \"dateReserved\": \"2024-09-11T15:12:18.248Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-13T05:29:15.926Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.