{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-46705", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.251Z", "datePublished": "2024-09-13T06:27:32.455Z", "dateUpdated": "2026-08-05T11:38:03.120Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:03.120Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: reset mmio mappings with devm\n\nSet our various mmio mappings to NULL. This should make it easier to\ncatch something rogue trying to mess with mmio after device removal. For\nexample, we might unmap everything and then start hitting some mmio\naddress which has already been unmamped by us and then remapped by\nsomething else, causing all kinds of carnage." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The dangling MMIO/GGTT mappings are dereferenced from `drm/xe` ioctl paths on `/dev/dri/renderD*` and from driver worker/teardown code, so the attack is delivered through local device-node access. No network or remote protocol handling is involved.\nAC:L - An attacker holding an open render node fd can continuously drive GGTT-insert and MMIO traffic, keeping the race window saturated across the device-removal event, and can trigger the removal side themselves on a hot-pluggable/Thunderbolt eGPU. This is a use-after-free-class defect where the attacker participates in both sides of the race.\nPR:L - All xe ioctls are marked `DRM_RENDER_ALLOW`, so an unprivileged local user in the standard `render`/`video` group — the default on desktops and inside many GPU-enabled containers — reaches `xe_ggtt_map_bo()` and the `xe_mmio_*` accessors. No CAP_SYS_ADMIN or root is needed to dereference the stale pointers.\nUI:N - The stale mappings are hit by the attacker's own ioctl stream and by the driver's asynchronous teardown/worker paths; no separate victim action is required, and on an eGPU/dock system the removal event itself is an action the attacker performs.\nS:U - The dangling iomem access and its consequences remain within the kernel's own security authority. There is no hypervisor or IOMMU boundary crossed by the defect itself.\nC:H - Reads through the stale `tile->mmio.regs`, `tile->mmio_ext.regs`, or `tile->mem.vram.mapping` alias return the contents of whatever device BAR has since been re-`ioremap()`'d into that virtual range, and those values are returned to userspace through query/debugfs paths — an unbounded cross-device information disclosure.\nI:H - `xe_ggtt_set_pte()` performs an attacker-influenced 64-bit `writeq()` at an attacker-influenced offset within an 8 MB window through the dangling `ggtt->gsm` alias, letting the attacker reprogram another PCI device's control registers, which is further leveragable into DMA-based arbitrary memory writes.\nA:H - Touching an already-unmapped iomem virtual address after `pci_iounmap()`/`iounmap()` faults in kernel context and oopses, and corrupting an unrelated device's registers reliably wedges or panics the machine." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/xe/xe_device.c", "drivers/gpu/drm/xe/xe_mmio.c", "drivers/gpu/drm/xe/xe_mmio.h" ], "versions": [ { "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "b1c9fbed3884d3883021d699c7cdf5253a65543a", "status": "affected", "versionType": "git" }, { "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "c7117419784f612d59ee565145f722e8b5541fe6", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/xe/xe_device.c", "drivers/gpu/drm/xe/xe_mmio.c", "drivers/gpu/drm/xe/xe_mmio.h" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.7", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.10.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b1c9fbed3884d3883021d699c7cdf5253a65543a" }, { "url": "https://git.kernel.org/stable/c/c7117419784f612d59ee565145f722e8b5541fe6" } ], "title": "drm/xe: reset mmio mappings with devm", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-29T15:03:07.858976Z", "id": "CVE-2024-46705", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T15:03:22.407Z" } } ] } }