{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-44967", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T05:34:56.667Z", "datePublished": "2024-09-04T18:56:44.814Z", "dateUpdated": "2026-08-05T11:37:21.298Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:21.298Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mgag200: Bind I2C lifetime to DRM device\n\nManaged cleanup with devm_add_action_or_reset() will release the I2C\nadapter when the underlying Linux device goes away. But the connector\nstill refers to it, so this cleanup leaves behind a stale pointer\nin struct drm_connector.ddc.\n\nBind the lifetime of the I2C adapter to the connector's lifetime by\nusing DRM's managed release. When the DRM device goes away (after\nthe Linux device) DRM will first clean up the connector and then\nclean up the I2C adapter." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires a local process holding an open `/dev/dri/cardN` file descriptor and issuing `DRM_IOCTL_MODE_GETCONNECTOR` after the mgag200 PCI device is unbound; there is no network- or adjacent-reachable path into the DRM connector probe.\nAC:L - The sequence is fully deterministic — hold the DRM fd open, let the driver unbind (devres always runs `i2c_del_adapter()` and `iounmap()` before the DRM device is released), then issue the ioctl; no race must be won and no uncontrollable memory layout is required to reach the stale `connector->ddc`.\nPR:L - The attacker only needs an unprivileged local session with access to the DRM card node (console user, `video` group, or logind ACL) to hold the fd and issue the ioctl; because `.remove` uses `drm_dev_unregister()` rather than `drm_dev_unplug()`, ioctls on the existing fd are not gated after teardown.\nUI:N - No victim action is needed — the attacker's own ioctl on its own file descriptor performs the dereference, and an administrator capable of unbinding the driver can drive the entire chain without any second party.\nS:U - The stale pointer, the dead I2C adapter, and the unmapped MMIO window are all kernel-internal resources under the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use of the released adapter dereferences a freed kobject name string (`dev_dbg`/`dev_err` on the unregistered `adap->dev`), and `RREG8()` through the iounmap'd `mdev->rmmio` reads from a vmalloc/ioremap VA range that may already be recycled by another mapping, disclosing kernel or foreign device state.\nI:H - The `bit_xfer` callbacks perform `WREG8()`/`iowrite8()` writes through the stale, potentially reallocated ioremap virtual address, and write into the torn-down `i2c_adapter`/`rt_mutex` state — an uncontrolled kernel write primitive consistent with High integrity impact for a use-after-free.\nA:H - The most likely outcome is an immediate kernel page fault/oops when the I2C bit-banging touches the unmapped register window, killing the server's primary console display driver and taking down the task in kernel context." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/mgag200/mgag200_i2c.c" ], "versions": [ { "version": "b279df242972ae816a75cf1cc732af836f999100", "lessThan": "55a6916db77102765b22855d3a0add4751988b7c", "status": "affected", "versionType": "git" }, { "version": "b279df242972ae816a75cf1cc732af836f999100", "lessThan": "81d34df843620e902dd04aa9205c875833d61c17", "status": "affected", "versionType": "git" }, { "version": "b279df242972ae816a75cf1cc732af836f999100", "lessThan": "9d96b91e03cba9dfcb4ac370c93af4dbc47d5191", "status": "affected", "versionType": "git" }, { "version": "b279df242972ae816a75cf1cc732af836f999100", "lessThan": "eb1ae34e48a09b7a1179c579aed042b032e408f4", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/mgag200/mgag200_i2c.c" ], "versions": [ { "version": "6.0", "status": "affected" }, { "version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.105", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.46", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.5", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.105" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.46" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.10.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/55a6916db77102765b22855d3a0add4751988b7c" }, { "url": "https://git.kernel.org/stable/c/81d34df843620e902dd04aa9205c875833d61c17" }, { "url": "https://git.kernel.org/stable/c/9d96b91e03cba9dfcb4ac370c93af4dbc47d5191" }, { "url": "https://git.kernel.org/stable/c/eb1ae34e48a09b7a1179c579aed042b032e408f4" } ], "title": "drm/mgag200: Bind I2C lifetime to DRM device", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-44967", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T17:39:27.630336Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:35.025Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:14:15.199Z" } } ] } }