CVE-2024-44982

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-44982
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails If the dpu_format_populate_layout() fails, then FB is prepared, but not cleaned up. This ends up leaking the pin_count on the GEM object and causes a splat during DRM file closure: msm_obj->pin_count WARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc [...] Call trace: update_lru_locked+0xc4/0xcc put_pages+0xac/0x100 msm_gem_free_object+0x138/0x180 drm_gem_object_free+0x1c/0x30 drm_gem_object_handle_put_unlocked+0x108/0x10c drm_gem_object_release_handle+0x58/0x70 idr_for_each+0x68/0xec drm_gem_release+0x28/0x40 drm_file_free+0x174/0x234 drm_release+0xb0/0x160 __fput+0xc0/0x2c8 __fput_sync+0x50/0x5c __arm64_sys_close+0x38/0x7c invoke_syscall+0x48/0x118 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x4c/0x120 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194 irq event stamp: 129818 hardirqs last enabled at (129817): [<ffffa5f6d953fcc0>] console_unlock+0x118/0x124 hardirqs last disabled at (129818): [<ffffa5f6da7dcf04>] el1_dbg+0x24/0x8c softirqs last enabled at (129808): [<ffffa5f6d94afc18>] handle_softirqs+0x4c8/0x4e8 softirqs last disabled at (129785): [<ffffa5f6d94105e4>] __do_softirq+0x14/0x20 Patchwork: https://patchwork.freedesktop.org/patch/600714/

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/02193c70723118889281f75b88722b26b58bf4ae Patch
https://git.kernel.org/stable/c/7ecf85542169012765e4c2817cd3be6c2e009962 Patch
https://git.kernel.org/stable/c/9b8b65211a880af8fe8330a101e1e239a2d4008f Patch
https://git.kernel.org/stable/c/a3c5815b07f4ee19d0b7e2ddf91ff9f03ecbf27d Patch
https://git.kernel.org/stable/c/bfa1a6283be390947d3649c482e5167186a37016 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*
History

10 Oct 2024, 17:09

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CWE CWE-459
CPE cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/02193c70723118889281f75b88722b26b58bf4ae - () https://git.kernel.org/stable/c/02193c70723118889281f75b88722b26b58bf4ae - Patch
References () https://git.kernel.org/stable/c/7ecf85542169012765e4c2817cd3be6c2e009962 - () https://git.kernel.org/stable/c/7ecf85542169012765e4c2817cd3be6c2e009962 - Patch
References () https://git.kernel.org/stable/c/9b8b65211a880af8fe8330a101e1e239a2d4008f - () https://git.kernel.org/stable/c/9b8b65211a880af8fe8330a101e1e239a2d4008f - Patch
References () https://git.kernel.org/stable/c/a3c5815b07f4ee19d0b7e2ddf91ff9f03ecbf27d - () https://git.kernel.org/stable/c/a3c5815b07f4ee19d0b7e2ddf91ff9f03ecbf27d - Patch
References () https://git.kernel.org/stable/c/bfa1a6283be390947d3649c482e5167186a37016 - () https://git.kernel.org/stable/c/bfa1a6283be390947d3649c482e5167186a37016 - Patch

05 Sep 2024, 12:53

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/msm/dpu: limpiar FB si dpu_format_populate_layout falla Si dpu_format_populate_layout() falla, entonces FB se prepara, pero no se limpia. Esto termina filtrando el pin_count en el objeto GEM y provoca un splat durante el cierre del archivo DRM: msm_obj-&gt;pin_count ADVERTENCIA: CPU: 2 PID: 569 en drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc [...] Rastreo de llamadas: update_lru_locked+0xc4/0xcc put_pages+0xac/0x100 msm_gem_free_object+0x138/0x180 drm_gem_object_free+0x1c/0x30 drm_gem_object_handle_put_unlocked+0x108/0x10c drm_gem_object_release_handle+0x58/0x70 idr_for_each+0x68/0xec drm_gem_release+0x28/0x40 drm_file_free+0x174/0x234 drm_release+0xb0/0x160 __fput+0xc0/0x2c8 __fput_sync+0x50/0x5c __arm64_sys_close+0x38/0x7c anybody_syscall+0x48/0x118 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x4c/0x120 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194 marca de evento irq: 129818 hardirqs habilitados por última vez en (129817): [] console_unlock+0x118/0x124 hardirqs deshabilitados por última vez en (129818): [] el1_dbg+0x24/0x8c softirqs habilitados por última vez en (129808): [] handle_softirqs+0x4c8/0x4e8 softirqs deshabilitados por última vez en (129785): [] __do_softirq+0x14/0x20 Patchwork: https://patchwork.freedesktop.org/patch/600714/

04 Sep 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-04 20:15

Updated : 2024-10-10 17:09

NVD link : CVE-2024-44982

Mitre link : CVE-2024-44982

CVE.ORG link : CVE-2024-44982

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-459

Incomplete Cleanup