CVE-2024-46705 (GCVE-0-2024-46705)
Vulnerability from cvelistv5
Published
2024-09-13 06:27
Modified
2026-08-05 11:38
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe: reset mmio mappings with devm Set our various mmio mappings to NULL. This should make it easier to catch something rogue trying to mess with mmio after device removal. For example, we might unmap everything and then start hitting some mmio address which has already been unmamped by us and then remapped by something else, causing all kinds of carnage.
References
Impacted products
Vendor Product Version
Linux Linux Version: dd08ebf6c3525a7ea2186e636df064ea47281987
Version: dd08ebf6c3525a7ea2186e636df064ea47281987
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:03:07.858976Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:03:22.407Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_device.c",
            "drivers/gpu/drm/xe/xe_mmio.c",
            "drivers/gpu/drm/xe/xe_mmio.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b1c9fbed3884d3883021d699c7cdf5253a65543a",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            },
            {
              "lessThan": "c7117419784f612d59ee565145f722e8b5541fe6",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_device.c",
            "drivers/gpu/drm/xe/xe_mmio.c",
            "drivers/gpu/drm/xe/xe_mmio.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: reset mmio mappings with devm\n\nSet our various mmio mappings to NULL. This should make it easier to\ncatch something rogue trying to mess with mmio after device removal. For\nexample, we might unmap everything and then start hitting some mmio\naddress which has already been unmamped by us and then remapped by\nsomething else, causing all kinds of carnage."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The dangling MMIO/GGTT mappings are dereferenced from `drm/xe` ioctl paths on `/dev/dri/renderD*` and from driver worker/teardown code, so the attack is delivered through local device-node access. No network or remote protocol handling is involved.\nAC:L - An attacker holding an open render node fd can continuously drive GGTT-insert and MMIO traffic, keeping the race window saturated across the device-removal event, and can trigger the removal side themselves on a hot-pluggable/Thunderbolt eGPU. This is a use-after-free-class defect where the attacker participates in both sides of the race.\nPR:L - All xe ioctls are marked `DRM_RENDER_ALLOW`, so an unprivileged local user in the standard `render`/`video` group \u2014 the default on desktops and inside many GPU-enabled containers \u2014 reaches `xe_ggtt_map_bo()` and the `xe_mmio_*` accessors. No CAP_SYS_ADMIN or root is needed to dereference the stale pointers.\nUI:N - The stale mappings are hit by the attacker\u0027s own ioctl stream and by the driver\u0027s asynchronous teardown/worker paths; no separate victim action is required, and on an eGPU/dock system the removal event itself is an action the attacker performs.\nS:U - The dangling iomem access and its consequences remain within the kernel\u0027s own security authority. There is no hypervisor or IOMMU boundary crossed by the defect itself.\nC:H - Reads through the stale `tile-\u003emmio.regs`, `tile-\u003emmio_ext.regs`, or `tile-\u003emem.vram.mapping` alias return the contents of whatever device BAR has since been re-`ioremap()`\u0027d into that virtual range, and those values are returned to userspace through query/debugfs paths \u2014 an unbounded cross-device information disclosure.\nI:H - `xe_ggtt_set_pte()` performs an attacker-influenced 64-bit `writeq()` at an attacker-influenced offset within an 8 MB window through the dangling `ggtt-\u003egsm` alias, letting the attacker reprogram another PCI device\u0027s control registers, which is further leveragable into DMA-based arbitrary memory writes.\nA:H - Touching an already-unmapped iomem virtual address after `pci_iounmap()`/`iounmap()` faults in kernel context and oopses, and corrupting an unrelated device\u0027s registers reliably wedges or panics the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:03.120Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b1c9fbed3884d3883021d699c7cdf5253a65543a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7117419784f612d59ee565145f722e8b5541fe6"
        }
      ],
      "title": "drm/xe: reset mmio mappings with devm",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46705",
    "datePublished": "2024-09-13T06:27:32.455Z",
    "dateReserved": "2024-09-11T15:12:18.251Z",
    "dateUpdated": "2026-08-05T11:38:03.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46705\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T15:03:07.858976Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T15:03:12.238Z\"}}], \"cna\": {\"title\": \"drm/xe: reset mmio mappings with devm\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"dd08ebf6c352\", \"lessThan\": \"b1c9fbed3884\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dd08ebf6c352\", \"lessThan\": \"c7117419784f\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/xe/xe_device.c\", \"drivers/gpu/drm/xe/xe_mmio.c\", \"drivers/gpu/drm/xe/xe_mmio.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/xe/xe_device.c\", \"drivers/gpu/drm/xe/xe_mmio.c\", \"drivers/gpu/drm/xe/xe_mmio.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b1c9fbed3884d3883021d699c7cdf5253a65543a\"}, {\"url\": \"https://git.kernel.org/stable/c/c7117419784f612d59ee565145f722e8b5541fe6\"}], \"x_generator\": {\"engine\": \"bippy-8e903de6a542\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe: reset mmio mappings with devm\\n\\nSet our various mmio mappings to NULL. This should make it easier to\\ncatch something rogue trying to mess with mmio after device removal. For\\nexample, we might unmap everything and then start hitting some mmio\\naddress which has already been unmamped by us and then remapped by\\nsomething else, causing all kinds of carnage.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-09T14:21:31.452Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46705\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-09T14:21:31.452Z\", \"dateReserved\": \"2024-09-11T15:12:18.251Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-13T06:27:32.455Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.