CVE-2024-52559 (GCVE-0-2024-52559)
Vulnerability from cvelistv5
Published
2025-02-27 02:18
Modified
2026-08-05 11:43
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit() The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32 values that come from the user via the submit_lookup_cmds() function. This addition could lead to an integer wrapping bug so use size_add() to prevent that. Patchwork: https://patchwork.freedesktop.org/patch/624696/
References
Impacted products
Vendor Product Version
Linux Linux Version: 198725337ef1f73b73e7dc953c6ffb0799f26ffe
Version: 198725337ef1f73b73e7dc953c6ffb0799f26ffe
Version: 198725337ef1f73b73e7dc953c6ffb0799f26ffe
Version: 198725337ef1f73b73e7dc953c6ffb0799f26ffe
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-52559",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:30:56.189127Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:36:41.115Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gem_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b99b2c4621d13bd4374ef384e8f1fc188d0a5df",
              "status": "affected",
              "version": "198725337ef1f73b73e7dc953c6ffb0799f26ffe",
              "versionType": "git"
            },
            {
              "lessThan": "2f1845e46c41ed500789d53dc45b383b7745c96c",
              "status": "affected",
              "version": "198725337ef1f73b73e7dc953c6ffb0799f26ffe",
              "versionType": "git"
            },
            {
              "lessThan": "e43a0f1327a1ee70754f8a0de6e0262cfa3e0b87",
              "status": "affected",
              "version": "198725337ef1f73b73e7dc953c6ffb0799f26ffe",
              "versionType": "git"
            },
            {
              "lessThan": "3a47f4b439beb98e955d501c609dfd12b7836d61",
              "status": "affected",
              "version": "198725337ef1f73b73e7dc953c6ffb0799f26ffe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gem_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.80",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()\n\nThe \"submit-\u003ecmd[i].size\" and \"submit-\u003ecmd[i].offset\" variables are u32\nvalues that come from the user via the submit_lookup_cmds() function.\nThis addition could lead to an integer wrapping bug so use size_add()\nto prevent that.\n\nPatchwork: https://patchwork.freedesktop.org/patch/624696/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the DRM_IOCTL_MSM_GEM_SUBMIT ioctl on a local /dev/dri/renderD* device node; there is no network or adjacent-network path to msm_ioctl_gem_submit().\nAC:L - Triggering requires only a single crafted ioctl with a size/offset pair whose 32-bit sum wraps, with no race, no timing window, and no dependence on memory layout the attacker cannot influence; the attacker also controls its own GPU address space allocations to position the resulting IB target.\nPR:L - The ioctl is registered DRM_RENDER_ALLOW with no DRM_AUTH, DRM_MASTER, or capability check, so any unprivileged process with an open render node fd qualifies \u2014 including sandboxed Android untrusted_app processes and ChromeOS GPU/renderer processes on Snapdragon hardware.\nUI:N - The attacking process performs the entire sequence itself by opening the render node and issuing the submit ioctl; no action by any other user is needed.\nS:U - The GPU SMMU is not bypassed \u2014 the bogus IB address is still translated by the GPU page tables \u2014 so the impact remains within the kernel\u0027s own security authority rather than crossing into a different one.\nC:H - The wrap yields an attacker-chosen GPU virtual address and length for CP_INDIRECT_BUFFER_PFE, letting the GPU fetch and execute command packets from memory outside the submitted buffer object, including other GPU clients\u0027 buffers and kernel-owned GPU structures, whose contents can be exfiltrated via memory-copy packets.\nI:H - Executing command packets sourced from out-of-bounds memory allows GPU-side writes (CP_MEM_WRITE and similar) to arbitrary mapped GPU addresses, corrupting other clients\u0027 buffers as well as kernel ringbuffer/memptr/fence state.\nA:H - Pointing the indirect buffer at unmapped GPU VA causes an SMMU translation fault, GPU hang, devcoredump and recovery, which an unprivileged process can trigger repeatedly to wedge graphics and compute on the device."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:17.624Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b99b2c4621d13bd4374ef384e8f1fc188d0a5df"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f1845e46c41ed500789d53dc45b383b7745c96c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e43a0f1327a1ee70754f8a0de6e0262cfa3e0b87"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a47f4b439beb98e955d501c609dfd12b7836d61"
        }
      ],
      "title": "drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-52559",
    "datePublished": "2025-02-27T02:18:07.106Z",
    "dateReserved": "2025-02-27T02:16:34.059Z",
    "dateUpdated": "2026-08-05T11:43:17.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:51:25.836Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()\\n\\nThe \\\"submit-\u003ecmd[i].size\\\" and \\\"submit-\u003ecmd[i].offset\\\" variables are u32\\nvalues that come from the user via the submit_lookup_cmds() function.\\nThis addition could lead to an integer wrapping bug so use size_add()\\nto prevent that.\\n\\nPatchwork: https://patchwork.freedesktop.org/patch/624696/\"}], \"affected\": [{\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"unaffected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"drivers/gpu/drm/msm/msm_gem_submit.c\"], \"versions\": [{\"version\": \"198725337ef1f73b73e7dc953c6ffb0799f26ffe\", \"lessThan\": \"2b99b2c4621d13bd4374ef384e8f1fc188d0a5df\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"198725337ef1f73b73e7dc953c6ffb0799f26ffe\", \"lessThan\": \"2f1845e46c41ed500789d53dc45b383b7745c96c\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"198725337ef1f73b73e7dc953c6ffb0799f26ffe\", \"lessThan\": \"e43a0f1327a1ee70754f8a0de6e0262cfa3e0b87\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"198725337ef1f73b73e7dc953c6ffb0799f26ffe\", \"lessThan\": \"3a47f4b439beb98e955d501c609dfd12b7836d61\", \"status\": \"affected\", \"versionType\": \"git\"}]}, {\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"affected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"drivers/gpu/drm/msm/msm_gem_submit.c\"], \"versions\": [{\"version\": \"3.12\", \"status\": \"affected\"}, {\"version\": \"0\", \"lessThan\": \"3.12\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.6.80\", \"lessThanOrEqual\": \"6.6.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.12.16\", \"lessThanOrEqual\": \"6.12.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.13.4\", \"lessThanOrEqual\": \"6.13.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.14\", \"lessThanOrEqual\": \"*\", \"status\": \"unaffected\", \"versionType\": \"original_commit_for_fix\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.12\", \"versionEndExcluding\": \"6.6.80\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.12\", \"versionEndExcluding\": \"6.12.16\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.12\", \"versionEndExcluding\": \"6.13.4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.12\", \"versionEndExcluding\": \"6.14\"}]}]}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2b99b2c4621d13bd4374ef384e8f1fc188d0a5df\"}, {\"url\": \"https://git.kernel.org/stable/c/2f1845e46c41ed500789d53dc45b383b7745c96c\"}, {\"url\": \"https://git.kernel.org/stable/c/e43a0f1327a1ee70754f8a0de6e0262cfa3e0b87\"}, {\"url\": \"https://git.kernel.org/stable/c/3a47f4b439beb98e955d501c609dfd12b7836d61\"}], \"title\": \"drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()\", \"x_generator\": {\"engine\": \"bippy-1.2.0\"}}, \"adp\": [{\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-52559\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:30:56.189127Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"CWE-190 Integer Overflow or Wraparound\"}]}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2025-10-01T16:55:19.387Z\"}, \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-52559\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2025-02-27T02:16:34.059Z\", \"datePublished\": \"2025-02-27T02:18:07.106Z\", \"dateUpdated\": \"2025-05-04T09:51:25.836Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.