CVE-2024-50030: drm/xe/ct: prevent UAF in send_recv()
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/ct: prevent UAF in sendrecv()
Ensure we serialize with completion side to prevent UAF with fence going out of scope on the stack, since we have no clue if it will fire after the timeout before we can erase from the xa. Also we have some dependent loads and stores for which we need the correct ordering, and we lack the needed barriers. Fix this by grabbing the ct->lock after the wait, which is also held by the completion side.
v2 (Badal): - Also print done after acquiring the lock and seeing timeout.
(cherry picked from commit 52789ce35c55ccd30c4b67b9cc5b2af55e0122ea)
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50030?
CVE-2024-50030 is rated as a high severity vulnerability due to its potential for causing user-after-free conditions.
How do I fix CVE-2024-50030?
To fix CVE-2024-50030, update the Linux kernel to version 6.11.4 or later, or ensure you are using the latest release version above 6.12-rc2.
Which Linux kernel versions are affected by CVE-2024-50030?
CVE-2024-50030 affects Linux kernel versions from 6.8 up to and including 6.11.4, as well as specific 6.12 release candidates.
What type of vulnerability is CVE-2024-50030?
CVE-2024-50030 is a user-after-free vulnerability that occurs in the send_recv() function of the Linux kernel.
Is there a known exploit for CVE-2024-50030?
As of now, there are no publicly known exploits specifically targeting CVE-2024-50030.