CVE-2024-49876: drm/xe: fix UAF around queue destruction
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: fix UAF around queue destruction
We currently do stuff like queuing the final destruction step on a random system wq, which will outlive the driver instance. With bad timing we can teardown the driver with one or more work workqueue still being alive leading to various UAF splats. Add a fini step to ensure user queues are properly torn down. At this point GuC should already be nuked so queue itself should no longer be referenced from hw pov.
v2 (Matt B) - Looks much safer to use a waitqueue and then just wait for the xaarray to become empty before triggering the drain.
(cherry picked from commit 861108666cc0e999cffeab6aff17b662e68774e3)
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49876?
The severity of CVE-2024-49876 is classified as medium due to potential risks associated with use-after-free vulnerabilities in the Linux kernel.
How do I fix CVE-2024-49876?
To fix CVE-2024-49876, you should update your Linux kernel to a version later than 6.10.14, 6.11.3, or 6.12-rc1.
What versions of the Linux kernel are affected by CVE-2024-49876?
CVE-2024-49876 affects the Linux kernel versions from 6.8 to 6.10.14 and from 6.11 to 6.11.3, as well as version 6.12-rc1.
What type of vulnerability is CVE-2024-49876?
CVE-2024-49876 is a use-after-free vulnerability related to queue destruction in the Linux kernel.
Is CVE-2024-49876 exploitable in production environments?
Yes, CVE-2024-49876 could potentially be exploited in production environments if systems are running affected versions of the Linux kernel.