{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-42259", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-30T07:40:12.257Z", "datePublished": "2024-08-14T14:50:49.844Z", "dateUpdated": "2026-08-05T11:36:08.919Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:08.919Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Fix Virtual Memory mapping boundaries calculation\n\nCalculating the size of the mapped area as the lesser value\nbetween the requested size and the actual size does not consider\nthe partial mapping offset. This can cause page fault access.\n\nFix the calculation of the starting and ending addresses, the\ntotal size is now deduced from the difference between the end and\nstart addresses.\n\nAdditionally, the calculations have been rewritten in a clearer\nand more understandable form.\n\n[Joonas: Add Requires: tag]\nRequires: 60a2066c5005 (\"drm/i915/gem: Adjust vma offset for framebuffer mmap offset\")\n(cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local access to the i915 DRM device node (`/dev/dri/renderD128` or `card0`) to issue GEM_CREATE/GEM_MMAP_OFFSET ioctls, mmap the returned fake offset, and take a page fault. There is no network-reachable path to `vm_fault_gtt()`.\nAC:L - The attacker fully controls every input: object size (larger than the mappable aperture, deterministically forcing the partial-view path), mmap length (chosen non-chunk-aligned so `partial.offset + min(vma->size, vma_len) > vma_len`), and the faulting address. No race, no dependence on uncontrolled memory layout.\nPR:L - Both `I915_GEM_CREATE` and `I915_GEM_MMAP_OFFSET` are `DRM_RENDER_ALLOW`, so an ordinary unprivileged user with render-node access — the logged-in desktop user, a member of the `render`/`video` group, or any container with `/dev/dri` passed through — can reach the code. No root or capability is needed.\nUI:N - The attacking process performs the ioctl, mmap and memory access entirely on its own; no victim action or interaction is involved.\nS:U - The corruption occurs in kernel-managed page tables and the GPU aperture within the same kernel security authority; this is standard local kernel compromise rather than a VM or IOMMU boundary crossing.\nC:H - Up to ~1 MB of aperture PTEs are installed outside the VMA and are never zapped by i915's revocation path (`unmap_mapping_range` clamps to the VMA), so after the GGTT window is reused the attacker keeps a live read window onto arbitrary physical pages — other processes' GEM buffers, framebuffers, ring buffers and GPU page tables.\nI:H - The same out-of-bounds PTEs are writable write-combining mappings, giving an out-of-bounds write over neighbouring VMAs' page tables and, via the unrevoked stale aperture mapping, write access to GGTT/PPGTT page-table objects — which converts into arbitrary DMA and kernel code execution.\nA:H - Page tables are populated for addresses covered by no VMA (and PTEs are overwritten in unrelated VMAs), producing the \"page fault access\" cited in the fix, pgtable accounting mismatches and oopses/panics; the attacker can trigger this repeatedly at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/i915/gem/i915_gem_mman.c" ], "versions": [ { "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "3e06073d24807f04b4694108a8474decb7b99e60", "status": "affected", "versionType": "git" }, { "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "a256d019eaf044864c7e50312f0a65b323c24f39", "status": "affected", "versionType": "git" }, { "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "50111a8098fb9ade621eeff82228a997d42732ab", "status": "affected", "versionType": "git" }, { "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "911f8055f175c82775d0fd8cedcd0b75413f4ba7", "status": "affected", "versionType": "git" }, { "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b", "status": "affected", "versionType": "git" }, { "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "4b09513ce93b3dcb590baaaff2ce96f2d098312d", "status": "affected", "versionType": "git" }, { "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "ead9289a51ea82eb5b27029fcf4c34b2dd60cf06", "status": "affected", "versionType": "git" }, { "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/i915/gem/i915_gem_mman.c" ], "versions": [ { "version": "4.9", "status": "affected" }, { "version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.320", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.282", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.224", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.165", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.106", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.46", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.5", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "4.19.320" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.4.282" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.224" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.106" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.46" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.10.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3e06073d24807f04b4694108a8474decb7b99e60" }, { "url": "https://git.kernel.org/stable/c/a256d019eaf044864c7e50312f0a65b323c24f39" }, { "url": "https://git.kernel.org/stable/c/50111a8098fb9ade621eeff82228a997d42732ab" }, { "url": "https://git.kernel.org/stable/c/911f8055f175c82775d0fd8cedcd0b75413f4ba7" }, { "url": "https://git.kernel.org/stable/c/e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b" }, { "url": "https://git.kernel.org/stable/c/4b09513ce93b3dcb590baaaff2ce96f2d098312d" }, { "url": "https://git.kernel.org/stable/c/ead9289a51ea82eb5b27029fcf4c34b2dd60cf06" }, { "url": "https://git.kernel.org/stable/c/8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3" }, { "url": "https://project-zero.issues.chromium.org/issues/42451707" } ], "title": "drm/i915/gem: Fix Virtual Memory mapping boundaries calculation", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-42259", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:12:50.301256Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:33.719Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:02:56.873Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T11:56:40.898Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ] } ] } }