CVE-2024-49984 (GCVE-0-2024-49984)
Vulnerability from cvelistv5
Published
2024-10-21 18:02
Modified
2026-08-05 11:40
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage where the ids will be copied into.
References
Impacted products
Vendor Product Version
Linux Linux Version: bae7cb5d68001a8d4ceec5964dda74bb9aab7220
Version: bae7cb5d68001a8d4ceec5964dda74bb9aab7220
Version: bae7cb5d68001a8d4ceec5964dda74bb9aab7220
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49984",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:32:07.530054Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:38:43.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3e50d72abe50204c7b19784a66e86da29dde32c2",
              "status": "affected",
              "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220",
              "versionType": "git"
            },
            {
              "lessThan": "d9536f16be3970c170571efa707c13cd089c774e",
              "status": "affected",
              "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220",
              "versionType": "git"
            },
            {
              "lessThan": "f32b5128d2c440368b5bf3a7a356823e235caabb",
              "status": "affected",
              "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Prevent out of bounds access in performance query extensions\n\nCheck that the number of perfmons userspace is passing in the copy and\nreset extensions is not greater than the internal kernel storage where\nthe ids will be copied into."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the DRM_IOCTL_V3D_SUBMIT_CPU ioctl on the local device node /dev/dri/renderD128, requiring local system access. No network or physical vector exists.\nAC:L - Triggering is fully deterministic \u2014 the attacker simply submits a CPU job extension with nperfmons \u003e 3 and controls the overflow length, content, and target allocation size via the same ioctl. No race, timing window, or unknowable memory-layout precondition is involved.\nPR:L - Only an open file descriptor on the DRM render node is needed; drm_ioctl_permit() waives DRM_AUTH for render clients, so no capabilities, DRM master status, or compositor authentication are required. This is available to any ordinary desktop/container/GPU-sandbox user on affected Raspberry Pi class systems.\nUI:N - The attacker triggers the overflow entirely from their own process via a single ioctl call. No victim action is involved.\nS:U - The corruption and its impact are confined to the kernel\u0027s own security authority; there is no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The controlled heap overflow and the forged drm_syncobj pointer yield arbitrary kernel memory read primitives, and the companion stack overflow in v3d_write_performance_query_result() copies out-of-bounds kernel stack contents into a user-mapped BO for direct disclosure.\nI:H - This is an out-of-bounds heap write with fully attacker-controlled content, length, and target slab cache, plus an arbitrary-address write through the overwritten syncobj pointer and a kernel stack overflow \u2014 all classic paths to arbitrary write and code execution.\nA:H - Overrunning the kvmalloc\u0027d array and dereferencing the corrupted syncobj pointer reliably produce kernel oops/panic, and the attacker can repeat it at will from an unprivileged process."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:53.662Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3e50d72abe50204c7b19784a66e86da29dde32c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9536f16be3970c170571efa707c13cd089c774e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f32b5128d2c440368b5bf3a7a356823e235caabb"
        }
      ],
      "title": "drm/v3d: Prevent out of bounds access in performance query extensions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49984",
    "datePublished": "2024-10-21T18:02:29.151Z",
    "dateReserved": "2024-10-21T12:17:06.054Z",
    "dateUpdated": "2026-08-05T11:40:53.662Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49984\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:32:07.530054Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:32:10.625Z\"}}], \"cna\": {\"title\": \"drm/v3d: Prevent out of bounds access in performance query extensions\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"bae7cb5d68001a8d4ceec5964dda74bb9aab7220\", \"lessThan\": \"3e50d72abe50204c7b19784a66e86da29dde32c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bae7cb5d68001a8d4ceec5964dda74bb9aab7220\", \"lessThan\": \"d9536f16be3970c170571efa707c13cd089c774e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bae7cb5d68001a8d4ceec5964dda74bb9aab7220\", \"lessThan\": \"f32b5128d2c440368b5bf3a7a356823e235caabb\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/v3d/v3d_submit.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/v3d/v3d_submit.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3e50d72abe50204c7b19784a66e86da29dde32c2\"}, {\"url\": \"https://git.kernel.org/stable/c/d9536f16be3970c170571efa707c13cd089c774e\"}, {\"url\": \"https://git.kernel.org/stable/c/f32b5128d2c440368b5bf3a7a356823e235caabb\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/v3d: Prevent out of bounds access in performance query extensions\\n\\nCheck that the number of perfmons userspace is passing in the copy and\\nreset extensions is not greater than the internal kernel storage where\\nthe ids will be copied into.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-27T12:17:04.986Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49984\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-27T12:17:04.986Z\", \"dateReserved\": \"2024-10-21T12:17:06.054Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:02:29.151Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.