CVE-2024-50149 (GCVE-0-2024-50149)
Vulnerability from cvelistv5
Published
2024-11-07 09:31
Modified
2026-08-05 11:42
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't free job in TDR Freeing job in TDR is not safe as TDR can pass the run_job thread resulting in UAF. It is only safe for free job to naturally be called by the scheduler. Rather free job in TDR, add to pending list. (cherry picked from commit ea2f6a77d0c40d97f4a4dc93fee4afe15d94926d)
References
Impacted products
Vendor Product Version
Linux Linux Version: e275d61c5f3ffc250b2a9601d36fbd11b4db774b
Version: e275d61c5f3ffc250b2a9601d36fbd11b4db774b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50149",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T14:25:51.665392Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T14:58:33.233Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_guc_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "be8fe75e57f8fa3f87e3b1c283cc7cd9f9b80867",
              "status": "affected",
              "version": "e275d61c5f3ffc250b2a9601d36fbd11b4db774b",
              "versionType": "git"
            },
            {
              "lessThan": "82926f52d7a09c65d916c0ef8d4305fc95d68c0c",
              "status": "affected",
              "version": "e275d61c5f3ffc250b2a9601d36fbd11b4db774b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_guc_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Don\u0027t free job in TDR\n\nFreeing job in TDR is not safe as TDR can pass the run_job thread\nresulting in UAF. It is only safe for free job to naturally be called by\nthe scheduler. Rather free job in TDR, add to pending list.\n\n(cherry picked from commit ea2f6a77d0c40d97f4a4dc93fee4afe15d94926d)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through DRM ioctls (`XE_EXEC_QUEUE_CREATE`, `XE_EXEC`, `XE_EXEC_QUEUE_DESTROY`) on a local `/dev/dri/renderD*` node of an Intel Xe GPU. No network or adjacent-network exposure exists.\nAC:L - The attacker controls both sides of the race \u2014 GPU batch duration determines when the fence signals, GuC CT saturation stalls `run_job()` past the TDR deadline, and the triggering \"exec queue closed immediately after last fence signaled\" pattern is described by the fix author as *common* \u2014 and it can be retried in a tight loop across many exec queues until won.\nPR:L - All required ioctls are marked `DRM_RENDER_ALLOW` with no `DRM_AUTH` or capability check, so any unprivileged local user (or sandboxed/containerized process such as a browser GPU process) holding an fd on the render node can trigger it.\nUI:N - The attacking process performs every step itself \u2014 create exec queue, submit a job with attacker-chosen execution time, close the queue \u2014 with no victim action required.\nS:U - The freed `xe_sched_job` and all subsequent accesses are kernel objects within the same security authority; no VM, IOMMU, or sandbox boundary is crossed by the corruption itself.\nC:H - The job is freed into a mergeable slab with no RCU delay, and the run_job worker then reads `sched_job-\u003es_fence`, `job-\u003efence`, and `job-\u003eq` from the reallocated memory, allowing an attacker who sprays the freed slot to steer dereferences and leak arbitrary kernel memory.\nI:H - After the free, `dma_fence_add_callback(fence, \u0026sched_job-\u003ecb, ...)` writes list pointers into the freed object and `drm_sched_job_done()`/`dma_fence_signal()` traverse callback lists and invoke `dma_fence_ops`/`dma_fence_cb-\u003efunc` pointers, giving a heap-spray-driven write and control-flow hijack primitive.\nA:H - The use-after-free corrupts the DRM scheduler\u0027s pending list and fence callback chains, reliably producing KASAN splats, oopses, and kernel panics; the buggy path additionally loses the job free, leaking memory and disturbing GPU submission state."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:02.810Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/be8fe75e57f8fa3f87e3b1c283cc7cd9f9b80867"
        },
        {
          "url": "https://git.kernel.org/stable/c/82926f52d7a09c65d916c0ef8d4305fc95d68c0c"
        }
      ],
      "title": "drm/xe: Don\u0027t free job in TDR",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50149",
    "datePublished": "2024-11-07T09:31:25.885Z",
    "dateReserved": "2024-10-21T19:36:19.959Z",
    "dateUpdated": "2026-08-05T11:42:02.810Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50149\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-11T14:25:51.665392Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-11T14:25:52.867Z\"}}], \"cna\": {\"title\": \"drm/xe: Don\u0027t free job in TDR\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e275d61c5f3ffc250b2a9601d36fbd11b4db774b\", \"lessThan\": \"be8fe75e57f8fa3f87e3b1c283cc7cd9f9b80867\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e275d61c5f3ffc250b2a9601d36fbd11b4db774b\", \"lessThan\": \"82926f52d7a09c65d916c0ef8d4305fc95d68c0c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/xe/xe_guc_submit.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/xe/xe_guc_submit.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/be8fe75e57f8fa3f87e3b1c283cc7cd9f9b80867\"}, {\"url\": \"https://git.kernel.org/stable/c/82926f52d7a09c65d916c0ef8d4305fc95d68c0c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe: Don\u0027t free job in TDR\\n\\nFreeing job in TDR is not safe as TDR can pass the run_job thread\\nresulting in UAF. It is only safe for free job to naturally be called by\\nthe scheduler. Rather free job in TDR, add to pending list.\\n\\n(cherry picked from commit ea2f6a77d0c40d97f4a4dc93fee4afe15d94926d)\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.6\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:47:18.409Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50149\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:47:18.409Z\", \"dateReserved\": \"2024-10-21T19:36:19.959Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-07T09:31:25.885Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.