CVE-2024-27400: drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: once more fix the call oder in amdgputtmmove() v2
This reverts drm/amdgpu: fix ftrace event amdgpubomove always move on same heap. The basic problem here is that after the move the old location is simply not available any more.
Some fixes were suggested, but essentially we should call the move notification before actually moving things because only this way we have the correct order for DMA-buf and VM move notifications as well.
Also rework the statistic handling so that we don't update the eviction counter before the move.
v2: add missing NULL check
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
Rework amdgpu_ttm_move() so that eviction statistics/counters are not updated before the move, and move/notification ordering is performed before the actual relocation to ensure correct DMA-buf and VM move notification order.
Linux kernel drm/amdgpu amdgpu_ttm_move() call order = Call the move notification before actually moving the TTM buffer/model; do not update the eviction counter before the move - Compensating control
If you cannot immediately update, ensure your kernel build does not include the faulty call order behavior where eviction counters are updated before the move and notifications occur after relocation (this restores the required ordering for DMA-buf/VM move notifications).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27400?
The severity of CVE-2024-27400 is classified as medium, indicating a moderate potential for impact.
How do I fix CVE-2024-27400?
To fix CVE-2024-27400, update the linux package to the recommended versions: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which Linux kernel versions are affected by CVE-2024-27400?
CVE-2024-27400 affects multiple Linux kernel versions including 5.10.x and 6.1.x.
Is CVE-2024-27400 a critical vulnerability?
CVE-2024-27400 is not considered a critical vulnerability but should still be addressed to maintain system security.
What software packages are impacted by CVE-2024-27400?
The linux package on Debian systems is impacted by CVE-2024-27400.