« Volver al listado

CVE-2024-46896

Estado: ModificadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: don't access invalid sched

Since 2320c9e6a768 ("drm/sched: memset() 'job' in drm_sched_job_init()") accessing job->base.sched can produce unexpected results as the initialisation of (*job)->base.sched done in amdgpu_job_alloc is overwritten by the memset.

This commit fixes an issue when a CS would fail validation and would be rejected after job->num_ibs is incremented. In this case, amdgpu_ib_free(ring->adev, ...) will be called, which would crash the machine because the ring value is bogus.

To fix this, pass a NULL pointer to amdgpu_ib_free(): we can do this because the device is actually not used in this function.

Leer descripción completaMostrar menos

The next commit will remove the ring argument completely.

(cherry picked from commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7)

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-46896",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "166df51487f46b6e997dfeea7ca0c2a970853f07",
              "lessThan": "65501a4fd84ecdc0af863dbb37759242aab9f2dd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "87210234e5a273ebf9c4110a6aa82b8221478daa",
              "lessThan": "da6b2c626ae73c303378ce9eaf6e3eaf16c9925a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2da108b4b5fb7ec04d7e951418ed80e97f7c35ad",
              "lessThan": "67291d601f2b032062b1b2f60ffef1b63e10094c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2320c9e6a768d135c7b0039995182bb1a4e4fd22",
              "lessThan": "a93b1020eb9386d7da11608477121b10079c076a",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_job.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1.120",
              "lessThan": "6.1.122",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.6.66",
              "lessThan": "6.6.68",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.12.5",
              "lessThan": "6.12.7",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_job.c"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-01-11T13:15:21.643",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/65501a4fd84ecdc0af863dbb37759242aab9f2dd",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/67291d601f2b032062b1b2f60ffef1b63e10094c",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a93b1020eb9386d7da11608477121b10079c076a",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/da6b2c626ae73c303378ce9eaf6e3eaf16c9925a",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: don't access invalid sched\n\nSince 2320c9e6a768 (\"drm/sched: memset() 'job' in drm_sched_job_init()\")\naccessing job->base.sched can produce unexpected results as the initialisation\nof (*job)->base.sched done in amdgpu_job_alloc is overwritten by the\nmemset.\n\nThis commit fixes an issue when a CS would fail validation and would\nbe rejected after job->num_ibs is incremented. In this case,\namdgpu_ib_free(ring->adev, ...) will be called, which would crash the\nmachine because the ring value is bogus.\n\nTo fix this, pass a NULL pointer to amdgpu_ib_free(): we can do this\nbecause the device is actually not used in this function.\n\nThe next commit will remove the ring argument completely.\n\n(cherry picked from commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7)"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdgpu: no acceder a sched no válido Desde 2320c9e6a768 (\"drm/sched: memset() 'job' en drm_sched_job_init()\") acceder a job->base.sched puede producir resultados inesperados ya que la inicialización de (*job)->base.sched realizada en amdgpu_job_alloc es sobrescrita por memset. Esta confirmación corrige un problema cuando un CS fallaría la validación y sería rechazado después de que se incremente job->num_ibs. En este caso, se llamará a amdgpu_ib_free(ring->adev, ...), lo que bloquearía la máquina porque el valor de ring es falso. Para corregir esto, pase un puntero NULL a amdgpu_ib_free(): podemos hacer esto porque el dispositivo en realidad no se usa en esta función. La próxima confirmación eliminará el argumento ring por completo. (seleccionado del commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7)"
    }
  ],
  "lastModified": "2026-06-17T07:56:09.850",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D170786-006C-4D21-8636-775E492BDF95",
              "versionEndExcluding": "6.1.122",
              "versionStartIncluding": "6.1.120"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "053D7514-A65B-4677-9DB5-A163387F6E0C",
              "versionEndExcluding": "6.6.68",
              "versionStartIncluding": "6.6.66"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75A4DB64-BDF2-4534-8F31-F0E6D0D72B3C",
              "versionEndExcluding": "6.12.7",
              "versionStartIncluding": "6.12.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE491969-75AE-4A6B-9A58-8FC5AF98798F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}