{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50096", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.944Z", "datePublished": "2024-11-05T17:04:58.689Z", "dateUpdated": "2026-08-05T11:41:39.174Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:39.174Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error\n\nThe `nouveau_dmem_copy_one` function ensures that the copy push command is\nsent to the device firmware but does not track whether it was executed\nsuccessfully.\n\nIn the case of a copy error (e.g., firmware or hardware failure), the\ncopy push command will be sent via the firmware channel, and\n`nouveau_dmem_copy_one` will likely report success, leading to the\n`migrate_to_ram` function returning a dirty HIGH_USER page to the user.\n\nThis can result in a security vulnerability, as a HIGH_USER page that may\ncontain sensitive or corrupted data could be returned to the user.\n\nTo prevent this vulnerability, we allocate a zero page. Thus, in case of\nan error, a non-dirty (zero) page will be returned to the user." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local access to the nouveau render node (/dev/dri/renderD*) to issue DRM_IOCTL_NOUVEAU_SVM_INIT/SVM_BIND and then fault on the migrated range from the attacker's own address space. There is no network-facing path to nouveau_dmem_migrate_to_ram().\nAC:L - The attacker fully controls both the migration (SVM_BIND MIGRATE) and the CPU fault that triggers migrate_to_ram, and can repeat it arbitrarily; the copy-error precondition was not a rare fault but the routine state of the driver, since the copy engine channel was non-privileged and every push hit HCE_PRIV errors (fixed separately in 04e0481526e3). Within a vulnerable configuration the leak is deterministic and reproducible on demand.\nPR:L - Both SVM ioctls are marked DRM_RENDER_ALLOW, requiring neither DRM_AUTH/DRM_MASTER nor any capability — only ordinary render-node access, which desktop session users hold by default and which is commonly exposed inside GPU-enabled containers. No root or CAP_SYS_ADMIN is needed.\nUI:N - The attacker performs every step in its own process — init SVM, migrate its own pages to VRAM, then touch them — with no action by any other user. No victim participation is required.\nS:U - The leaked page is installed into the attacking process's own address space by the kernel that owns the vulnerable code; no VM, IOMMU, or sandbox authority boundary is crossed. Impact stays within the kernel/userspace security authority.\nC:H - The user is handed a full page of uninitialized buddy-allocator memory whose contents are whatever was last freed system-wide — page cache (arbitrary file data), other processes' freed anonymous memory, freed kernel pages containing keys, credentials, and pointers usable to defeat KASLR. The attacker can loop the migrate/fault cycle over a large VA range to harvest recycled physical pages continuously, amounting to a broad arbitrary-memory-read primitive rather than a bounded leak.\nI:H - A full page of a process's SVM-backed data is silently replaced with allocator-recycled content while the fault reports success (ret == 0, no SIGBUS), so the corruption is undetectable to the application. An attacker who grooms the page allocator can influence which freed content is recycled, injecting chosen bytes into the address space of a victim — potentially privileged — process using nouveau SVM.\nA:L - The kernel itself does not panic, but the application silently consumes garbage in place of its real data, which can crash or wedge the consuming process. The impact is degradation of the affected workload rather than a system-wide denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/nouveau/nouveau_dmem.c" ], "versions": [ { "version": "5be73b690875f7eb2d2defb54ccd7f2f12074984", "lessThan": "fd9bb7e996bab9b9049fffe3f3d3b50dee191d27", "status": "affected", "versionType": "git" }, { "version": "5be73b690875f7eb2d2defb54ccd7f2f12074984", "lessThan": "73f75d2b5aee5a735cf64b8ab4543d5c20dbbdd9", "status": "affected", "versionType": "git" }, { "version": "5be73b690875f7eb2d2defb54ccd7f2f12074984", "lessThan": "8c3de9282dde21ce3c1bf1bde3166a4510547aa9", "status": "affected", "versionType": "git" }, { "version": "5be73b690875f7eb2d2defb54ccd7f2f12074984", "lessThan": "614bfb2050982d23d53d0d51c4079dba0437c883", "status": "affected", "versionType": "git" }, { "version": "5be73b690875f7eb2d2defb54ccd7f2f12074984", "lessThan": "697e3ddcf1f8b68bd531fc34eead27c000bdf3e1", "status": "affected", "versionType": "git" }, { "version": "5be73b690875f7eb2d2defb54ccd7f2f12074984", "lessThan": "ab4d113b6718b076046018292f821d5aa4b844f8", "status": "affected", "versionType": "git" }, { "version": "5be73b690875f7eb2d2defb54ccd7f2f12074984", "lessThan": "835745a377a4519decd1a36d6b926e369b3033e2", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/nouveau/nouveau_dmem.c" ], "versions": [ { "version": "5.1", "status": "affected" }, { "version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.285", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.227", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.57", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.4", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.4.285" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.10.227" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.1.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.6.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.11.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/fd9bb7e996bab9b9049fffe3f3d3b50dee191d27" }, { "url": "https://git.kernel.org/stable/c/73f75d2b5aee5a735cf64b8ab4543d5c20dbbdd9" }, { "url": "https://git.kernel.org/stable/c/8c3de9282dde21ce3c1bf1bde3166a4510547aa9" }, { "url": "https://git.kernel.org/stable/c/614bfb2050982d23d53d0d51c4079dba0437c883" }, { "url": "https://git.kernel.org/stable/c/697e3ddcf1f8b68bd531fc34eead27c000bdf3e1" }, { "url": "https://git.kernel.org/stable/c/ab4d113b6718b076046018292f821d5aa4b844f8" }, { "url": "https://git.kernel.org/stable/c/835745a377a4519decd1a36d6b926e369b3033e2" } ], "title": "nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-50096", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:22:49.170573Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:27:19.250Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:25:26.216Z" } } ] } }