{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-49984", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T12:17:06.054Z", "datePublished": "2024-10-21T18:02:29.151Z", "dateUpdated": "2026-08-05T11:40:53.662Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:40:53.662Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Prevent out of bounds access in performance query extensions\n\nCheck that the number of perfmons userspace is passing in the copy and\nreset extensions is not greater than the internal kernel storage where\nthe ids will be copied into." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached through the DRM_IOCTL_V3D_SUBMIT_CPU ioctl on the local device node /dev/dri/renderD128, requiring local system access. No network or physical vector exists.\nAC:L - Triggering is fully deterministic — the attacker simply submits a CPU job extension with nperfmons > 3 and controls the overflow length, content, and target allocation size via the same ioctl. No race, timing window, or unknowable memory-layout precondition is involved.\nPR:L - Only an open file descriptor on the DRM render node is needed; drm_ioctl_permit() waives DRM_AUTH for render clients, so no capabilities, DRM master status, or compositor authentication are required. This is available to any ordinary desktop/container/GPU-sandbox user on affected Raspberry Pi class systems.\nUI:N - The attacker triggers the overflow entirely from their own process via a single ioctl call. No victim action is involved.\nS:U - The corruption and its impact are confined to the kernel's own security authority; there is no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The controlled heap overflow and the forged drm_syncobj pointer yield arbitrary kernel memory read primitives, and the companion stack overflow in v3d_write_performance_query_result() copies out-of-bounds kernel stack contents into a user-mapped BO for direct disclosure.\nI:H - This is an out-of-bounds heap write with fully attacker-controlled content, length, and target slab cache, plus an arbitrary-address write through the overwritten syncobj pointer and a kernel stack overflow — all classic paths to arbitrary write and code execution.\nA:H - Overrunning the kvmalloc'd array and dereferencing the corrupted syncobj pointer reliably produce kernel oops/panic, and the attacker can repeat it at will from an unprivileged process." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/v3d/v3d_submit.c" ], "versions": [ { "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220", "lessThan": "3e50d72abe50204c7b19784a66e86da29dde32c2", "status": "affected", "versionType": "git" }, { "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220", "lessThan": "d9536f16be3970c170571efa707c13cd089c774e", "status": "affected", "versionType": "git" }, { "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220", "lessThan": "f32b5128d2c440368b5bf3a7a356823e235caabb", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/v3d/v3d_submit.c" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.14", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.3", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.10.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.11.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3e50d72abe50204c7b19784a66e86da29dde32c2" }, { "url": "https://git.kernel.org/stable/c/d9536f16be3970c170571efa707c13cd089c774e" }, { "url": "https://git.kernel.org/stable/c/f32b5128d2c440368b5bf3a7a356823e235caabb" } ], "title": "drm/v3d: Prevent out of bounds access in performance query extensions", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-49984", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-22T13:32:07.530054Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:38:43.870Z" } } ] } }