CVE-2024-50090 drm/xe/oa: Fix overflow in oa batch buffer
A buffer overflow in the Linux kernel's Xe GPU driver can cause a system crash or assertion failure when reusing batch buffers for performance monitoring.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50090?
CVE-2024-50090 is a high-severity vulnerability in Linux kernel, published on 5 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa: Fix overflow in oa batch buffer
By default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch buffer, this is not a problem if batch buffer is only used once but oa reuses the batch buffer for the same metric and at each call it appends a MI_BATCH_BUFFER_END, printing the warning below and then overflowing.
[ 381.072016] ------------[ cut here ]------------ [ 381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed! platform: LUNARLAKE subplatform: 1 graphics: Xe2_LPG / Xe2_HPG 20.04 step B0 media: Xe2_LPM / Xe2_HPM 20.00 step B0 tile: 0 VRAM 0 B GT: 0 type 1
So here checking if batch buffer already have MI_BATCH_BUFFER_END if not append it.
v2: - simply fix, suggestion from Ashutosh
(cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)
Weakness: CWE-120
Which versions are affected by CVE-2024-50090?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-50090?
Apply the vendor's patch.
Is CVE-2024-50090 being exploited?
There is no known exploitation of CVE-2024-50090 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-52617, AZL-52816, BELL-CVE-2024-50090, DEBIAN-CVE-2024-50090, GHSA-qq43-74jj-93fp, ROOT-OS-UBUNTU-2204-CVE-2024-50090 and 1 more.