CVE-2024-35817: drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: amdgputtmgartbind set gtt bound flag
Otherwise after the GTT bo is released, the GTT and gart space is freed but amdgputtmbackendunbind will not clear the gart page table entry and leave valid mapping entry pointing to the stale system page. Then if GPU access the gart address mistakely, it will read undefined value instead page fault, harder to debug and reproduce the real issue.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: amdgputtmgartbind set gtt bound flag
The Linux kernel CVE team has assigned CVE-2024-35817 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051743-CVE-2024-35817-d29b@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.154 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.84 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.24 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.12 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35817?
CVE-2024-35817 is a critical vulnerability in the Linux kernel affecting the amdgpu driver, which could lead to system instability or unauthorized access.
How do I fix CVE-2024-35817?
To fix CVE-2024-35817, upgrade to the latest kernel versions 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3, or 6.9 for Red Hat and versions 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1 for Debian.
Which software versions are affected by CVE-2024-35817?
CVE-2024-35817 affects older versions of the Linux kernel including certain versions prior to 5.15.154 and those in the 6.x series up to 6.9.
What component of the Linux kernel does CVE-2024-35817 impact?
CVE-2024-35817 impacts the amdgpu driver in the Linux kernel, specifically affecting GTT and GART memory management.
Is there a known exploit for CVE-2024-35817?
As of now, there are no publicly disclosed exploits for CVE-2024-35817, but it is advised to patch systems to mitigate potential risks.