CVE-2024-58086 (GCVE-0-2024-58086)
Vulnerability from cvelistv5
Published
2025-03-06 16:28
Modified
2026-08-05 11:47
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Stop active perfmon if it is being destroyed If the active performance monitor (`v3d->active_perfmon`) is being destroyed, stop it first. Currently, the active perfmon is not stopped during destruction, leaving the `v3d->active_perfmon` pointer stale. This can lead to undefined behavior and instability. This patch ensures that the active perfmon is stopped before being destroyed, aligning with the behavior introduced in commit 7d1fd3638ee3 ("drm/v3d: Stop the active perfmon before being destroyed").
References
Impacted products
Vendor Product Version
Linux Linux Version: 26a4dc29b74a137f45665089f6d3d633fcc9b662
Version: 26a4dc29b74a137f45665089f6d3d633fcc9b662
Version: 26a4dc29b74a137f45665089f6d3d633fcc9b662
Version: 26a4dc29b74a137f45665089f6d3d633fcc9b662
Version: 26a4dc29b74a137f45665089f6d3d633fcc9b662
Version: 26a4dc29b74a137f45665089f6d3d633fcc9b662
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:34:21.647Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:38:59.062Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_perfmon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22e19c8c5f6b709f4ae40227392a30d57bac187d",
              "status": "affected",
              "version": "26a4dc29b74a137f45665089f6d3d633fcc9b662",
              "versionType": "git"
            },
            {
              "lessThan": "95036d4c01167568166108d42c2b0e9f8dbd7d2b",
              "status": "affected",
              "version": "26a4dc29b74a137f45665089f6d3d633fcc9b662",
              "versionType": "git"
            },
            {
              "lessThan": "eb0e0eca0eab93f310c6c37b8564049366704691",
              "status": "affected",
              "version": "26a4dc29b74a137f45665089f6d3d633fcc9b662",
              "versionType": "git"
            },
            {
              "lessThan": "1c5673a2c8926adbb61f340c779b28e18188a8cd",
              "status": "affected",
              "version": "26a4dc29b74a137f45665089f6d3d633fcc9b662",
              "versionType": "git"
            },
            {
              "lessThan": "f8805b12f477bd964e2820a87921c7b58cc2dee3",
              "status": "affected",
              "version": "26a4dc29b74a137f45665089f6d3d633fcc9b662",
              "versionType": "git"
            },
            {
              "lessThan": "21f1435b1e6b012a07c42f36b206d2b66fc8f13b",
              "status": "affected",
              "version": "26a4dc29b74a137f45665089f6d3d633fcc9b662",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_perfmon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.79",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Stop active perfmon if it is being destroyed\n\nIf the active performance monitor (`v3d-\u003eactive_perfmon`) is being\ndestroyed, stop it first. Currently, the active perfmon is not\nstopped during destruction, leaving the `v3d-\u003eactive_perfmon` pointer\nstale. This can lead to undefined behavior and instability.\n\nThis patch ensures that the active perfmon is stopped before being\ndestroyed, aligning with the behavior introduced in commit\n7d1fd3638ee3 (\"drm/v3d: Stop the active perfmon before being destroyed\")."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through DRM ioctls (`V3D_PERFMON_CREATE/DESTROY`, `V3D_SUBMIT_CL/CSD`) on the local `/dev/dri/renderD*` device node. No network or physical component is involved.\nAC:L - No race is required \u2014 the attacker performs a deterministic, fully self-controlled sequence (create perfmon, submit a job with it, wait for the fence, destroy it, submit another job) and additionally controls the freed object\u0027s slab size via `ncounters` and the reclaim window before the stale pointer is used.\nPR:L - The perfmon ioctls are `DRM_RENDER_ALLOW` with no `DRM_AUTH` or capability check, so any local unprivileged user with render-node access (standard for GUI/GPU users on Raspberry Pi OS, Android apps, embedded/kiosk V3D systems) can trigger it. No root or DRM master privilege is needed.\nUI:N - A single unprivileged process performs every step itself via ioctls on its own file descriptor. No victim action or interaction is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale `v3d-\u003eactive_perfmon` is dereferenced after `kfree()`, reading `perfmon-\u003encounters` and `perfmon-\u003evalues[]` from a slab slot the attacker can reclaim with a chosen object; `v3d_write_performance_query_result()` and `v3d_perfmon_get_values_ioctl()` can copy such freed-memory contents back to userspace, giving kernel memory disclosure.\nI:H - `v3d_perfmon_stop()` writes into the freed object \u2014 `mutex_lock()` stores the `current` task pointer into the owner field and `perfmon-\u003evalues[i] += V3D_CORE_READ(...)` performs a read-modify-write at attacker-chosen offsets \u2014 over a slab slot of attacker-chosen size that can be re-occupied by a victim object, yielding a corruption primitive suitable for privilege escalation.\nA:H - Dereferencing the freed perfmon reliably oopses the kernel; the sibling fix for the identical root cause documents a fatal paging fault in `__mutex_lock` from the `v3d_bin` scheduler kthread, killing the GPU pipeline and panicking the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:37.348Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22e19c8c5f6b709f4ae40227392a30d57bac187d"
        },
        {
          "url": "https://git.kernel.org/stable/c/95036d4c01167568166108d42c2b0e9f8dbd7d2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb0e0eca0eab93f310c6c37b8564049366704691"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c5673a2c8926adbb61f340c779b28e18188a8cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8805b12f477bd964e2820a87921c7b58cc2dee3"
        },
        {
          "url": "https://git.kernel.org/stable/c/21f1435b1e6b012a07c42f36b206d2b66fc8f13b"
        }
      ],
      "title": "drm/v3d: Stop active perfmon if it is being destroyed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58086",
    "datePublished": "2025-03-06T16:28:23.042Z",
    "dateReserved": "2025-03-06T15:52:09.184Z",
    "dateUpdated": "2026-08-05T11:47:37.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.