CVE-2024-50187

CVE-2024-50187

High · published November 8, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
13.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Stop the active perfmon before being destroyed

Upon closing the file descriptor, the active performance monitor is not

stopped. Although all perfmons are destroyed in `vc4_perfmon_close_file()`,

the active performance monitor's pointer (`vc4->active_perfmon`) is still

retained.

If we open a new file descriptor and submit a few jobs with performance

monitors, the driver will attempt to stop the active performance monitor

using the stale pointer in `vc4->active_perfmon`. However, this pointer

is no longer valid because the previous process has already terminated,

and all performance monitors associated with it have been destroyed and

freed.

To fix this, when the active performance monitor belongs to a given

process, explicitly stop it before destroying and freeing it.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.1th percentile
Published
2024-11-08T11:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 4.17, < 6.1.1136.1.113
linux/linux_kernel≥ 6.2, < 6.6.576.6.57
linux/linux_kernel≥ 6.7, < 6.11.46.11.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (5)
EPSS history
Timeline
  • 08 NOV 05:38Z
    drm/vc4: Stop the active perfmon before being destroyed
    cvelistv5