CVE-2024-50282 drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
A missing size check in the AMD GPU driver allows a buffer overflow, potentially enabling local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50282?
CVE-2024-50282 is a high-severity memory corruption vulnerability in Linux kernel, published on 19 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
Avoid a possible buffer overflow if size is larger than 4K.
(cherry picked from commit f5d873f5825b40d886d03bd2aede91d4cf002434)
Weakness: CWE-120
Which versions are affected by CVE-2024-50282?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-50282?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-50282 being exploited?
There is no known exploitation of CVE-2024-50282 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-53501, AZL-53691, BELL-CVE-2024-50282, DEBIAN-CVE-2024-50282, GHSA-h9rp-4669-xxx3, ROOT-OS-DEBIAN-11-CVE-2024-50282 and 2 more.