{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2024-42264",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2024-07-30T07:40:12.259Z",
        "datePublished": "2024-08-17T08:54:20.908Z",
        "dateUpdated": "2026-08-05T11:36:09.987Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T11:36:09.987Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Prevent out of bounds access in performance query extensions\n\nCheck that the number of perfmons userspace is passing in the copy and\nreset extensions is not greater than the internal kernel storage where\nthe ids will be copied into.\n\n(cherry picked from commit f32b5128d2c440368b5bf3a7a356823e235caabb)"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The overflow is reached only through the DRM_IOCTL_V3D_SUBMIT_CPU ioctl on the local v3d render node (/dev/dri/renderD128); there is no remote or adjacent-network path to this code.\nAC:L - A single ioctl with an oversized nperfmons deterministically performs the out-of-bounds write, with the attacker choosing the allocation size, overflow length and every written dword; no race, timing window, or uncontrollable state is involved.\nPR:L - Only an open file descriptor on the GPU render node is needed — DRM_AUTH is bypassed for render clients (drm_ioctl.c:606) and no capability check exists on the path, so any local user with normal graphics access (including sandboxed GPU/container processes) qualifies.\nUI:N - The attacker triggers the bug entirely from their own process via a single ioctl; no victim action or interaction is required.\nS:U - The corruption occurs in kernel heap memory within the same security authority; this is standard local kernel privilege escalation with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The controlled heap overflow can overwrite adjacent slab objects and the in-struct drm_syncobj pointer, which is later dereferenced — yielding pointer-corruption primitives readily leveraged for arbitrary kernel memory disclosure.\nI:H - This is an unbounded out-of-bounds write where both the length and every written 32-bit value are fully attacker-controlled, and the overwritten syncobj pointer is subsequently dereferenced and refcount-decremented — a direct route to arbitrary kernel memory corruption and control-flow hijack.\nA:H - Writing past the kvmalloc'd queries buffer corrupts slab metadata and adjacent objects and dereferences an attacker-supplied pointer, reliably producing an oops or kernel panic."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/v3d/v3d_submit.c"
                    ],
                    "versions": [
                        {
                            "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220",
                            "lessThan": "73ad583bd4938bf37d2709fc36901eb6f22f2722",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "bae7cb5d68001a8d4ceec5964dda74bb9aab7220",
                            "lessThan": "6ce9efd12ae81cf46bf44eb0348594558dfbb9d2",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/v3d/v3d_submit.c"
                    ],
                    "versions": [
                        {
                            "version": "6.8",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.8",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.10.4",
                            "lessThanOrEqual": "6.10.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.11",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.8",
                                    "versionEndExcluding": "6.10.4"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.8",
                                    "versionEndExcluding": "6.11"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/73ad583bd4938bf37d2709fc36901eb6f22f2722"
                },
                {
                    "url": "https://git.kernel.org/stable/c/6ce9efd12ae81cf46bf44eb0348594558dfbb9d2"
                }
            ],
            "title": "drm/v3d: Prevent out of bounds access in performance query extensions",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "id": "CVE-2024-42264",
                                "role": "CISA Coordinator",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "version": "2.0.3",
                                "timestamp": "2024-09-10T16:12:34.023274Z"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2024-09-12T17:33:32.942Z"
                }
            }
        ]
    }
}