{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-56652", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-27T15:00:39.841Z", "datePublished": "2024-12-27T15:06:16.454Z", "dateUpdated": "2026-08-05T11:45:49.934Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:45:49.934Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/reg_sr: Remove register pool\n\nThat pool implementation doesn't really work: if the krealloc happens to\nmove the memory and return another address, the entries in the xarray\nbecome invalid, leading to use-after-free later:\n\n\tBUG: KASAN: slab-use-after-free in xe_reg_sr_apply_mmio+0x570/0x760 [xe]\n\tRead of size 4 at addr ffff8881244b2590 by task modprobe/2753\n\n\tAllocated by task 2753:\n\t kasan_save_stack+0x39/0x70\n\t kasan_save_track+0x14/0x40\n\t kasan_save_alloc_info+0x37/0x60\n\t __kasan_kmalloc+0xc3/0xd0\n\t __kmalloc_node_track_caller_noprof+0x200/0x6d0\n\t krealloc_noprof+0x229/0x380\n\nSimplify the code to fix the bug. A better pooling strategy may be added\nback later if needed.\n\n(cherry picked from commit e5283bd4dfecbd3335f43b62a68e24dae23f59e4)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is in the i915/xe GPU driver and is reached through local driver init and through GT/engine resets driven by a local DRM render-node client; there is no network-reachable path.\nAC:L - The dangling pointers arise deterministically whenever a save/restore table exceeds 16 entries (the normal case on modern platforms — the KASAN splat comes from a plain modprobe), and there is no race to win: the attacker can re-trigger the use of the freed entries at will by forcing GT resets.\nPR:L - A basic unprivileged user with an fd on /dev/dri/renderD* — standard for any desktop, container or GPU-compute session — can submit a hanging exec queue to force the GT reset that re-walks the dangling entries, and can spray the freed kmalloc-256 slab beforehand.\nUI:N - The corrupt xarray is built automatically during driver probe and the reset path is triggered entirely by the attacker's own GPU submissions; no victim action is required.\nS:U - The use-after-free, the out-of-bounds iomem write and the resulting corruption all occur within the host kernel's own security authority; no VM, sandbox or IOMMU boundary is crossed.\nC:H - This is a slab use-after-free read: freed heap contents are consumed as register descriptors and are additionally printed verbatim through the xe_reg_sr_dump() debugfs interface, and the UAF gives the attacker control over freed-object contents enabling broader disclosure.\nI:H - Freed memory supplies both the 28-bit offset and the value of an unbounded writel(val, mmio->regs + addr) against a SZ_4M mapping, yielding an out-of-bounds kernel iomem write plus arbitrary GT register reprogramming — including the RING_FORCE_TO_NONPRIV whitelist slots that gate what unprivileged GPU batches may touch.\nA:H - A KASAN-confirmed use-after-free that programs garbage register addresses/values into the GPU on every GT reset, wedging the device and causing oopses/panics from writes past the ioremapped BAR window; it can be re-triggered repeatedly." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/xe/xe_reg_sr.c", "drivers/gpu/drm/xe/xe_reg_sr_types.h" ], "versions": [ { "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "b0193a31a0ca5a0f9e60bb4a86537d46b98111b8", "status": "affected", "versionType": "git" }, { "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "d7b028656c29b22fcde1c6ee1df5b28fbba987b5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/xe/xe_reg_sr.c", "drivers/gpu/drm/xe/xe_reg_sr_types.h" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.6", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b0193a31a0ca5a0f9e60bb4a86537d46b98111b8" }, { "url": "https://git.kernel.org/stable/c/d7b028656c29b22fcde1c6ee1df5b28fbba987b5" } ], "title": "drm/xe/reg_sr: Remove register pool", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-56652", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-02-11T15:41:38.610298Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T15:45:21.406Z" } } ] } }