CVE-2024-50090

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50090

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix overflow in oa batch buffer By default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch buffer, this is not a problem if batch buffer is only used once but oa reuses the batch buffer for the same metric and at each call it appends a MI_BATCH_BUFFER_END, printing the warning below and then overflowing. [ 381.072016] ------------[ cut here ]------------ [ 381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed! platform: LUNARLAKE subplatform: 1 graphics: Xe2_LPG / Xe2_HPG 20.04 step B0 media: Xe2_LPM / Xe2_HPM 20.00 step B0 tile: 0 VRAM 0 B GT: 0 type 1 So here checking if batch buffer already have MI_BATCH_BUFFER_END if not append it. v2: - simply fix, suggestion from Ashutosh (cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)

References
Link Resource
https://git.kernel.org/stable/c/6c10ba06bb1b48acce6d4d9c1e33beb9954f1788 Patch
https://git.kernel.org/stable/c/bcb5be3421705e682b0b32073ad627056d6bc2a2 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

18 Feb 2025, 16:15

Type Values Removed Values Added
CWE CWE-120

12 Nov 2024, 21:41

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/6c10ba06bb1b48acce6d4d9c1e33beb9954f1788 - () https://git.kernel.org/stable/c/6c10ba06bb1b48acce6d4d9c1e33beb9954f1788 - Patch
References () https://git.kernel.org/stable/c/bcb5be3421705e682b0b32073ad627056d6bc2a2 - () https://git.kernel.org/stable/c/bcb5be3421705e682b0b32073ad627056d6bc2a2 - Patch
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-noinfo

06 Nov 2024, 18:17

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/xe/oa: Corregir desbordamiento en el búfer por lotes de oa. De manera predeterminada, xe_bb_create_job() agrega un MI_BATCH_BUFFER_END al buffer por lotes, esto no es un problema si el buffer por lotes solo se usa una vez, pero oa reutiliza el búfer por lotes para la misma métrica y en cada llamada agrega un MI_BATCH_BUFFER_END, imprimiendo la advertencia a continuación y luego desbordándose. [ 381.072016] ------------[ cortar aquí ]------------ [ 381.072019] xe 0000:00:02.0: [drm] ¡La afirmación `bb-&gt;len * 4 + bb_prefetch(q-&gt;gt) &lt;= size` falló! Plataforma: LUNARLAKE Subplataforma: 1 Gráficos: Xe2_LPG / Xe2_HPG 20.04 Paso B0 Medios: Xe2_LPM / Xe2_HPM 20.00 Paso B0 Mosaico: 0 VRAM 0 B GT: 0 Tipo 1 Aquí se verifica si el buffer de lote ya tiene MI_BATCH_BUFFER_END si no, se agrega. v2: - simplemente se arregla, sugerencia de Ashutosh (seleccionada del commit 9ba0e0f30ca42a98af3689460063edfb6315718a)

05 Nov 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-05 17:15

Updated : 2025-02-18 16:15

NVD link : CVE-2024-50090

Mitre link : CVE-2024-50090

CVE.ORG link : CVE-2024-50090

JSON object : View

Products Affected

linux

CWE
NVD-CWE-noinfo CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')