{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-46710", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.252Z", "datePublished": "2024-09-13T06:33:42.285Z", "dateUpdated": "2026-08-05T11:38:05.250Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:05.250Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Prevent unmapping active read buffers\n\nThe kms paths keep a persistent map active to read and compare the cursor\nbuffer. These maps can race with each other in simple scenario where:\na) buffer \"a\" mapped for update\nb) buffer \"a\" mapped for compare\nc) do the compare\nd) unmap \"a\" for compare\ne) update the cursor\nf) unmap \"a\" for update\nAt step \"e\" the buffer has been unmapped and the read contents is bogus.\n\nPrevent unmapping of active read buffers by simply keeping a count of\nhow many paths have currently active maps and unmap only when the count\nreaches 0." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The only route to the racing map/unmap pairs is the DRM cursor/atomic-commit ioctl path on /dev/dri/card* (`drm_mode_cursor_ioctl`, `drm_mode_atomic_ioctl`) plus the vmwgfx VKMS CRC worker, all of which require a local open of the GPU device node. No network, adjacent-network, or physical-bus data reaches this code.\nAC:L - The attacker controls both sides of the race — vmwgfx exposes 8 cursor planes, so the same GEM-backed cursor framebuffer can be bound to several planes and hammered from concurrent threads, with `prepare_fb` mapping while another CRTC's `cleanup_fb`/`vmw_user_object_unmap` tears the shared cached map down. The window can be retried without limit and no attacker-uncontrollable precondition exists.\nPR:L - The ioctls are gated only on DRM master, not on any capability; a locally logged-in user receives the card node via logind ACL (or `video` group) and becomes master on open when no compositor holds it, which is the normal case on a headless or console-only VMware guest. Real root in the initial namespace is not needed.\nUI:N - The attacker performs every step itself — allocating the dumb buffer, binding it as a cursor framebuffer, and issuing the concurrent cursor/atomic commits. No victim action or cooperating process is required.\nS:U - The corrupted vmalloc range and the leaked data both belong to the same guest kernel that hosts the vulnerable driver, so the impact stays within one security authority. Being a paravirtual guest driver does not let this cross into the hypervisor.\nC:H - After `vunmap()` the cached virtual address can be reused by any other vmalloc allocation, and the read paths (`memcmp` in `vmw_du_cursor_plane_has_changed`, the 16 KB `memcpy` source in `vmw_cursor_update_mob`, and `crc32_le` in `compute_crc`) then pull that reclaimed kernel memory into the displayed cursor image or a userspace-visible CRC. This is a stale-mapping read of effectively arbitrary kernel memory, not a bounded leak.\nI:H - `vmw_cursor_update_mob()` performs `memset(header, 0, ...)` and a 16 KB `memcpy` of fully attacker-controlled dumb-buffer pixel data through the stale mapping, writing chosen bytes into whatever vmalloc allocation reclaimed that address range. With CONFIG_VMAP_STACK the same 16 KB granularity is used for kernel thread stacks, giving a realistic path to control-flow hijack.\nA:H - If the purged vmap area has not been reused, the subsequent read or write dereferences unmapped kernel virtual addresses, producing an immediate kernel page fault/oops; if it has been reused, the 16 KB overwrite corrupts unrelated kernel state and panics the system. Either outcome is a full crash, and it is repeatable on demand." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c", "drivers/gpu/drm/vmwgfx/vmwgfx_bo.h" ], "versions": [ { "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "lessThan": "58a3714db4d9dcaeb9fc4905141e17b9f536c0a5", "status": "affected", "versionType": "git" }, { "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "lessThan": "0851b1ec650adadcaa23ec96daad95a55bf966f0", "status": "affected", "versionType": "git" }, { "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "lessThan": "d5228d158e4c0b1663b3983044913c15c3d0135e", "status": "affected", "versionType": "git" }, { "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "lessThan": "aba07b9a0587f50e5d3346eaa19019cf3f86c0ea", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c", "drivers/gpu/drm/vmwgfx/vmwgfx_bo.h" ], "versions": [ { "version": "5.19", "status": "affected" }, { "version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.54", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.8", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.54" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.10.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/58a3714db4d9dcaeb9fc4905141e17b9f536c0a5" }, { "url": "https://git.kernel.org/stable/c/0851b1ec650adadcaa23ec96daad95a55bf966f0" }, { "url": "https://git.kernel.org/stable/c/d5228d158e4c0b1663b3983044913c15c3d0135e" }, { "url": "https://git.kernel.org/stable/c/aba07b9a0587f50e5d3346eaa19019cf3f86c0ea" } ], "title": "drm/vmwgfx: Prevent unmapping active read buffers", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-29T14:59:47.963109Z", "id": "CVE-2024-46710", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T15:00:04.356Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:16:37.924Z" } } ] } }