CVE-2024-49876
Severity CVSS v4.0:
Pending analysis
Type:
CWE-416
Use After Free
Publication date:
21/10/2024
Last modified:
24/10/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
drm/xe: fix UAF around queue destruction<br />
<br />
We currently do stuff like queuing the final destruction step on a<br />
random system wq, which will outlive the driver instance. With bad<br />
timing we can teardown the driver with one or more work workqueue still<br />
being alive leading to various UAF splats. Add a fini step to ensure<br />
user queues are properly torn down. At this point GuC should already be<br />
nuked so queue itself should no longer be referenced from hw pov.<br />
<br />
v2 (Matt B)<br />
- Looks much safer to use a waitqueue and then just wait for the<br />
xa_array to become empty before triggering the drain.<br />
<br />
(cherry picked from commit 861108666cc0e999cffeab6aff17b662e68774e3)
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.8 (including) | 6.10.14 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.11 (including) | 6.11.3 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



