CVE-2024-49876

Severity CVSS v4.0:
Pending analysis
Type:
CWE-416 Use After Free
Publication date:
21/10/2024
Last modified:
24/10/2024

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe: fix UAF around queue destruction<br /> <br /> We currently do stuff like queuing the final destruction step on a<br /> random system wq, which will outlive the driver instance. With bad<br /> timing we can teardown the driver with one or more work workqueue still<br /> being alive leading to various UAF splats. Add a fini step to ensure<br /> user queues are properly torn down. At this point GuC should already be<br /> nuked so queue itself should no longer be referenced from hw pov.<br /> <br /> v2 (Matt B)<br /> - Looks much safer to use a waitqueue and then just wait for the<br /> xa_array to become empty before triggering the drain.<br /> <br /> (cherry picked from commit 861108666cc0e999cffeab6aff17b662e68774e3)

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.8 (including) 6.10.14 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.11 (including) 6.11.3 (excluding)
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*