CVE-2024-50090CWE-120

CVE-2024-50090

High · published November 5, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/oa: Fix overflow in oa batch buffer

By default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch

buffer, this is not a problem if batch buffer is only used once but

oa reuses the batch buffer for the same metric and at each call

it appends a MI_BATCH_BUFFER_END, printing the warning below and then

overflowing.

[ 381.072016] ------------[ cut here ]------------

[ 381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed!

platform: LUNARLAKE subplatform: 1

graphics: Xe2_LPG / Xe2_HPG 20.04 step B0

media: Xe2_LPM / Xe2_HPM 20.00 step B0

tile: 0 VRAM 0 B

GT: 0 type 1

So here checking if batch buffer already have MI_BATCH_BUFFER_END if

not append it.

v2:

- simply fix, suggestion from Ashutosh

(cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00217 · 11.5th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2024-11-05T22:15Z
Affected products (1)
ProductVersionsFixed in
linux/linux_kernel< 6.11.46.11.4
References (2)
EPSS history
Timeline
  • 05 NOV 17:04Z
    drm/xe/oa: Fix overflow in oa batch buffer
    cvelistv5