Log in Start free

Vulnerability · Published Oct 21, 2024 · Assigned by Linux

CVE-2024-49876drm/xe: fix UAF around queue destruction

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 84.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix UAF around queue destruction We currently do stuff like queuing the final destruction step on a random system wq, which will outlive the driver instance. With bad timing we can teardown the driver with one or more work workqueue still being alive leading to various UAF splats. Add a fini step to ensure user queues are properly torn down. At this point GuC should already be nuked so queue itself should no longer be referenced from hw pov. v2 (Matt B) - Looks much safer to use a waitqueue and then just wait for the xa_array to become empty before triggering the drain. (cherry picked from commit 861108666cc0e999cffeab6aff17b662e68774e3)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.11.4-1DEBIAN-CVE-2024-49876
Debian:14linux6.11.4-1DEBIAN-CVE-2024-49876
Ubuntu:24.04:LTSlinux6.8.0-54.56UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-aws6.8.0-1023.25UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1023.25~22.04.1UBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-azure6.8.0-1025.30UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1025.30~22.04.1UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-gcp6.8.0-1024.26UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1024.26~22.04.1UBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-gke6.8.0-1019.23UBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1006.8UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-57.59~22.04.1UBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-ibm6.8.0-1022.22UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-54.56.1UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-54.56.1~22.04.1UBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1022.25UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1022.25~22.04.2UBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1022.25.2UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1015.15UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1024.24UBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-oracle6.8.0-1020.21UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1020.21~22.04.1UBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-raspi6.8.0-1019.23UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-49876
Ubuntu:24.04:LTSlinux-riscv6.8.0-53.55.1UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-53.55.1~22.04.1UBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-49876
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-49876

Affected products (as reported)

VendorProductVersions
Linux Linux dd08ebf6c3525a7ea2186e636df064ea47281987 – before 272b0e78874586d6ccae04079d75b27b47705544dd08ebf6c3525a7ea2186e636df064ea47281987 – before 421c74670b0f9d5c007f1276d3647aa58f407fdedd08ebf6c3525a7ea2186e636df064ea47281987 – before 2d2be279f1ca9e7288282d4214f16eea8a727cdb
Linux Linux 6.8

References