CVE-2024-50221 (GCVE-0-2024-50221)

Vulnerability from cvelistv5 – Published: 2024-11-09 10:14 – Updated: 2026-08-05 11:42
VLAI
Title
drm/amd/pm: Vangogh: Fix kernel memory out of bounds write
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Vangogh: Fix kernel memory out of bounds write KASAN reports that the GPU metrics table allocated in vangogh_tables_init() is not large enough for the memset done in smu_cmn_init_soft_gpu_metrics(). Condensed report follows: [ 33.861314] BUG: KASAN: slab-out-of-bounds in smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu] [ 33.861799] Write of size 168 at addr ffff888129f59500 by task mangoapp/1067 ... [ 33.861808] CPU: 6 UID: 1000 PID: 1067 Comm: mangoapp Tainted: G W 6.12.0-rc4 #356 1a56f59a8b5182eeaf67eb7cb8b13594dd23b544 [ 33.861816] Tainted: [W]=WARN [ 33.861818] Hardware name: Valve Galileo/Galileo, BIOS F7G0107 12/01/2023 [ 33.861822] Call Trace: [ 33.861826] <TASK> [ 33.861829] dump_stack_lvl+0x66/0x90 [ 33.861838] print_report+0xce/0x620 [ 33.861853] kasan_report+0xda/0x110 [ 33.862794] kasan_check_range+0xfd/0x1a0 [ 33.862799] __asan_memset+0x23/0x40 [ 33.862803] smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779] [ 33.863306] vangogh_get_gpu_metrics_v2_4+0x123/0xad0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779] [ 33.864257] vangogh_common_get_gpu_metrics+0xb0c/0xbc0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779] [ 33.865682] amdgpu_dpm_get_gpu_metrics+0xcc/0x110 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779] [ 33.866160] amdgpu_get_gpu_metrics+0x154/0x2d0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779] [ 33.867135] dev_attr_show+0x43/0xc0 [ 33.867147] sysfs_kf_seq_show+0x1f1/0x3b0 [ 33.867155] seq_read_iter+0x3f8/0x1140 [ 33.867173] vfs_read+0x76c/0xc50 [ 33.867198] ksys_read+0xfb/0x1d0 [ 33.867214] do_syscall_64+0x90/0x160 ... [ 33.867353] Allocated by task 378 on cpu 7 at 22.794876s: [ 33.867358] kasan_save_stack+0x33/0x50 [ 33.867364] kasan_save_track+0x17/0x60 [ 33.867367] __kasan_kmalloc+0x87/0x90 [ 33.867371] vangogh_init_smc_tables+0x3f9/0x840 [amdgpu] [ 33.867835] smu_sw_init+0xa32/0x1850 [amdgpu] [ 33.868299] amdgpu_device_init+0x467b/0x8d90 [amdgpu] [ 33.868733] amdgpu_driver_load_kms+0x19/0xf0 [amdgpu] [ 33.869167] amdgpu_pci_probe+0x2d6/0xcd0 [amdgpu] [ 33.869608] local_pci_probe+0xda/0x180 [ 33.869614] pci_device_probe+0x43f/0x6b0 Empirically we can confirm that the former allocates 152 bytes for the table, while the latter memsets the 168 large block. Root cause appears that when GPU metrics tables for v2_4 parts were added it was not considered to enlarge the table to fit. The fix in this patch is rather "brute force" and perhaps later should be done in a smarter way, by extracting and consolidating the part version to size logic to a common helper, instead of brute forcing the largest possible allocation. Nevertheless, for now this works and fixes the out of bounds write. v2: * Drop impossible v3_0 case. (Mario) (cherry picked from commit 0880f58f9609f0200483a49429af0f050d281703)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 41cec40bc9baba83d36a0718ea94bfe63189274a , < f111de0f010308949254ee1cc45df8e6b8e1d7d4 (git)
Affected: 41cec40bc9baba83d36a0718ea94bfe63189274a , < f8fd9f0d57af4f8f48b383ec28287af85b47cb9f (git)
Affected: 41cec40bc9baba83d36a0718ea94bfe63189274a , < 4aa923a6e6406b43566ef6ac35a3d9a3197fa3e8 (git)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.63 , ≤ 6.6.* (semver)
Unaffected: 6.11.7 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50221",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T15:09:21.051694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T15:18:34.907Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f111de0f010308949254ee1cc45df8e6b8e1d7d4",
              "status": "affected",
              "version": "41cec40bc9baba83d36a0718ea94bfe63189274a",
              "versionType": "git"
            },
            {
              "lessThan": "f8fd9f0d57af4f8f48b383ec28287af85b47cb9f",
              "status": "affected",
              "version": "41cec40bc9baba83d36a0718ea94bfe63189274a",
              "versionType": "git"
            },
            {
              "lessThan": "4aa923a6e6406b43566ef6ac35a3d9a3197fa3e8",
              "status": "affected",
              "version": "41cec40bc9baba83d36a0718ea94bfe63189274a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.63",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.7",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Vangogh: Fix kernel memory out of bounds write\n\nKASAN reports that the GPU metrics table allocated in\nvangogh_tables_init() is not large enough for the memset done in\nsmu_cmn_init_soft_gpu_metrics(). Condensed report follows:\n\n[   33.861314] BUG: KASAN: slab-out-of-bounds in smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu]\n[   33.861799] Write of size 168 at addr ffff888129f59500 by task mangoapp/1067\n...\n[   33.861808] CPU: 6 UID: 1000 PID: 1067 Comm: mangoapp Tainted: G        W          6.12.0-rc4 #356 1a56f59a8b5182eeaf67eb7cb8b13594dd23b544\n[   33.861816] Tainted: [W]=WARN\n[   33.861818] Hardware name: Valve Galileo/Galileo, BIOS F7G0107 12/01/2023\n[   33.861822] Call Trace:\n[   33.861826]  \u003cTASK\u003e\n[   33.861829]  dump_stack_lvl+0x66/0x90\n[   33.861838]  print_report+0xce/0x620\n[   33.861853]  kasan_report+0xda/0x110\n[   33.862794]  kasan_check_range+0xfd/0x1a0\n[   33.862799]  __asan_memset+0x23/0x40\n[   33.862803]  smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.863306]  vangogh_get_gpu_metrics_v2_4+0x123/0xad0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.864257]  vangogh_common_get_gpu_metrics+0xb0c/0xbc0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.865682]  amdgpu_dpm_get_gpu_metrics+0xcc/0x110 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.866160]  amdgpu_get_gpu_metrics+0x154/0x2d0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[   33.867135]  dev_attr_show+0x43/0xc0\n[   33.867147]  sysfs_kf_seq_show+0x1f1/0x3b0\n[   33.867155]  seq_read_iter+0x3f8/0x1140\n[   33.867173]  vfs_read+0x76c/0xc50\n[   33.867198]  ksys_read+0xfb/0x1d0\n[   33.867214]  do_syscall_64+0x90/0x160\n...\n[   33.867353] Allocated by task 378 on cpu 7 at 22.794876s:\n[   33.867358]  kasan_save_stack+0x33/0x50\n[   33.867364]  kasan_save_track+0x17/0x60\n[   33.867367]  __kasan_kmalloc+0x87/0x90\n[   33.867371]  vangogh_init_smc_tables+0x3f9/0x840 [amdgpu]\n[   33.867835]  smu_sw_init+0xa32/0x1850 [amdgpu]\n[   33.868299]  amdgpu_device_init+0x467b/0x8d90 [amdgpu]\n[   33.868733]  amdgpu_driver_load_kms+0x19/0xf0 [amdgpu]\n[   33.869167]  amdgpu_pci_probe+0x2d6/0xcd0 [amdgpu]\n[   33.869608]  local_pci_probe+0xda/0x180\n[   33.869614]  pci_device_probe+0x43f/0x6b0\n\nEmpirically we can confirm that the former allocates 152 bytes for the\ntable, while the latter memsets the 168 large block.\n\nRoot cause appears that when GPU metrics tables for v2_4 parts were added\nit was not considered to enlarge the table to fit.\n\nThe fix in this patch is rather \"brute force\" and perhaps later should be\ndone in a smarter way, by extracting and consolidating the part version to\nsize logic to a common helper, instead of brute forcing the largest\npossible allocation. Nevertheless, for now this works and fixes the out of\nbounds write.\n\nv2:\n * Drop impossible v3_0 case. (Mario)\n\n(cherry picked from commit 0880f58f9609f0200483a49429af0f050d281703)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only by a local `read()` on the sysfs attribute `/sys/class/drm/cardN/device/gpu_metrics`, as shown by the commit\u0027s own KASAN trace (`ksys_read` \u2192 `dev_attr_show` \u2192 `amdgpu_get_gpu_metrics`). There is no network or adjacent-network path to this code.\nAC:L - A single `cat` of the sysfs file deterministically triggers the 168-byte memset over the 152-byte allocation every time \u2014 no race, no memory-layout grooming, and no victim state is required. The Vangogh APU and SMU firmware version are properties of the affected configuration rather than conditions outside the attacker\u0027s control.\nPR:L - The `gpu_metrics` attribute is declared `AMDGPU_DEVICE_ATTR_RO`, i.e. `S_IRUGO`/0444, so any local unprivileged account can read it with no capability, DRM-master, or device-node access. The upstream report itself records a UID 1000 process (`mangoapp`) hitting the overflow.\nUI:N - The attacker performs the triggering read directly; no other user must open a file, mount anything, or take any action.\nS:U - The overflow corrupts kernel slab memory belonging to the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - `amdgpu_get_gpu_metrics()` memcpy\u0027s 168 bytes out of the 152-byte allocation into the sysfs buffer returned to userspace, so an unprivileged reader receives 16 bytes read past the end of the heap object, and the accompanying slab corruption is of a class leverageable for further disclosure.\nI:H - This is an out-of-bounds heap write (CWE-787) \u2014 16 bytes of 0xFF plus 12 bytes of firmware-derived values written past the end of a `kzalloc`\u0027d object \u2014 which per kernel scoring practice is treated as high integrity impact.\nA:H - The write is a slab-out-of-bounds condition that produces a KASAN BUG, a SLUB redzone-overwritten report, or a KFENCE guard-page fault, and on kernels configured with `panic_on_warn` this becomes an unprivileged, repeatable kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:35.779Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f111de0f010308949254ee1cc45df8e6b8e1d7d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8fd9f0d57af4f8f48b383ec28287af85b47cb9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4aa923a6e6406b43566ef6ac35a3d9a3197fa3e8"
        }
      ],
      "title": "drm/amd/pm: Vangogh: Fix kernel memory out of bounds write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50221",
    "datePublished": "2024-11-09T10:14:32.390Z",
    "dateReserved": "2024-10-21T19:36:19.973Z",
    "dateUpdated": "2026-08-05T11:42:35.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50221",
      "date": "2026-08-09",
      "epss": "0.00245",
      "percentile": "0.15732"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:26:59.000Z",
      "cve": "CVE-2024-50221",
      "id": "msrc_CVE-2024-50221",
      "initial_release_date": "2024-11-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amd/pm: Vangogh: Fix kernel memory out of bounds write",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50221.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50221\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-09T11:15:07.600\",\"lastModified\":\"2026-06-17T08:03:54.340\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/pm: Vangogh: Fix kernel memory out of bounds write\\n\\nKASAN reports that the GPU metrics table allocated in\\nvangogh_tables_init() is not large enough for the memset done in\\nsmu_cmn_init_soft_gpu_metrics(). Condensed report follows:\\n\\n[   33.861314] BUG: KASAN: slab-out-of-bounds in smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu]\\n[   33.861799] Write of size 168 at addr ffff888129f59500 by task mangoapp/1067\\n...\\n[   33.861808] CPU: 6 UID: 1000 PID: 1067 Comm: mangoapp Tainted: G        W          6.12.0-rc4 #356 1a56f59a8b5182eeaf67eb7cb8b13594dd23b544\\n[   33.861816] Tainted: [W]=WARN\\n[   33.861818] Hardware name: Valve Galileo/Galileo, BIOS F7G0107 12/01/2023\\n[   33.861822] Call Trace:\\n[   33.861826]  \u003cTASK\u003e\\n[   33.861829]  dump_stack_lvl+0x66/0x90\\n[   33.861838]  print_report+0xce/0x620\\n[   33.861853]  kasan_report+0xda/0x110\\n[   33.862794]  kasan_check_range+0xfd/0x1a0\\n[   33.862799]  __asan_memset+0x23/0x40\\n[   33.862803]  smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\\n[   33.863306]  vangogh_get_gpu_metrics_v2_4+0x123/0xad0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\\n[   33.864257]  vangogh_common_get_gpu_metrics+0xb0c/0xbc0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\\n[   33.865682]  amdgpu_dpm_get_gpu_metrics+0xcc/0x110 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\\n[   33.866160]  amdgpu_get_gpu_metrics+0x154/0x2d0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\\n[   33.867135]  dev_attr_show+0x43/0xc0\\n[   33.867147]  sysfs_kf_seq_show+0x1f1/0x3b0\\n[   33.867155]  seq_read_iter+0x3f8/0x1140\\n[   33.867173]  vfs_read+0x76c/0xc50\\n[   33.867198]  ksys_read+0xfb/0x1d0\\n[   33.867214]  do_syscall_64+0x90/0x160\\n...\\n[   33.867353] Allocated by task 378 on cpu 7 at 22.794876s:\\n[   33.867358]  kasan_save_stack+0x33/0x50\\n[   33.867364]  kasan_save_track+0x17/0x60\\n[   33.867367]  __kasan_kmalloc+0x87/0x90\\n[   33.867371]  vangogh_init_smc_tables+0x3f9/0x840 [amdgpu]\\n[   33.867835]  smu_sw_init+0xa32/0x1850 [amdgpu]\\n[   33.868299]  amdgpu_device_init+0x467b/0x8d90 [amdgpu]\\n[   33.868733]  amdgpu_driver_load_kms+0x19/0xf0 [amdgpu]\\n[   33.869167]  amdgpu_pci_probe+0x2d6/0xcd0 [amdgpu]\\n[   33.869608]  local_pci_probe+0xda/0x180\\n[   33.869614]  pci_device_probe+0x43f/0x6b0\\n\\nEmpirically we can confirm that the former allocates 152 bytes for the\\ntable, while the latter memsets the 168 large block.\\n\\nRoot cause appears that when GPU metrics tables for v2_4 parts were added\\nit was not considered to enlarge the table to fit.\\n\\nThe fix in this patch is rather \\\"brute force\\\" and perhaps later should be\\ndone in a smarter way, by extracting and consolidating the part version to\\nsize logic to a common helper, instead of brute forcing the largest\\npossible allocation. Nevertheless, for now this works and fixes the out of\\nbounds write.\\n\\nv2:\\n * Drop impossible v3_0 case. (Mario)\\n\\n(cherry picked from commit 0880f58f9609f0200483a49429af0f050d281703)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/pm: Vangogh: Se corrige la escritura fuera de los l\u00edmites en la memoria del kernel KASAN informa que la tabla de m\u00e9tricas de GPU asignada en vangogh_tables_init() no es lo suficientemente grande para el conjunto de memoria realizado en smu_cmn_init_soft_gpu_metrics(). A continuaci\u00f3n se muestra el informe condensado: [33.861314] ERROR: KASAN: slab-out-of-limits en smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu] [33.861799] Escritura de tama\u00f1o 168 en la direcci\u00f3n ffff888129f59500 por la tarea mangoapp/1067 ... [33.861808] CPU: 6 UID: 1000 PID: 1067 Comm: mangoapp Contaminado: GW 6.12.0-rc4 #356 1a56f59a8b5182eeaf67eb7cb8b13594dd23b544 [33.861816] Contaminado: [W]=WARN [ 33.861818] Nombre del hardware: Valve Galileo/Galileo, BIOS F7G0107 01/12/2023 [ 33.861822] Seguimiento de llamadas: [ 33.861826]  [ 33.861829] dump_stack_lvl+0x66/0x90 [ 33.861838] print_report+0xce/0x620 [ 33.861853] kasan_report+0xda/0x110 [ 33.862794] kasan_check_range+0xfd/0x1a0 [ 33.862799] __asan_memset+0x23/0x40 [ 33.862803] smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779] [ 33.863306] vangogh_get_gpu_metrics_v2_4+0x123/0xad0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779] [ 33.864257] vangogh_common_get_gpu_metrics+0xb0c/0xbc0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779] [ 33.865682] amdgpu_dpm_get_gpu_metrics+0xcc/0x110 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779] [ 33.866160] amdgpu_get_gpu_metrics+0x154/0x2d0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779] [ 33.867135] dev_attr_show+0x43/0xc0 [ 33.867147] sysfs_kf_seq_show+0x1f1/0x3b0 [ 33.867155] seq_read_iter+0x3f8/0x1140 [ 33.867173] vfs_read+0x76c/0xc50 [ 33.867198] ksys_read+0xfb/0x1d0 [ 33.867214] do_syscall_64+0x90/0x160 ... [ 33.867353] Asignado por la tarea 378 en la CPU 7 a los 22.794876 s: [ 33.867358] kasan_save_stack+0x33/0x50 [ 33.867364] kasan_save_track+0x17/0x60 [ 33.867367] __kasan_kmalloc+0x87/0x90 [ 33.867371] vangogh_init_smc_tables+0x3f9/0x840 [amdgpu] [ 33.867835] smu_sw_init+0xa32/0x1850 [amdgpu] [ 33.868299] amdgpu_device_init+0x467b/0x8d90 [amdgpu] [ 33.868733] amdgpu_driver_load_kms+0x19/0xf0 [amdgpu] [ 33.869167] amdgpu_pci_probe+0x2d6/0xcd0 [amdgpu] [ 33.869608] local_pci_probe+0xda/0x180 [ 33.869614] pci_device_probe+0x43f/0x6b0 Emp\u00edricamente podemos confirmar que el primero asigna 152 bytes para la tabla, mientras que el segundo asigna el bloque grande de 168 bytes. La causa ra\u00edz parece ser que cuando se agregaron las tablas de m\u00e9tricas de GPU para las partes v2_4, no se consider\u00f3 agrandar la tabla para que se ajuste. La soluci\u00f3n en este parche es m\u00e1s bien \\\"fuerza bruta\\\" y quiz\u00e1s m\u00e1s adelante se deber\u00eda hacer de una manera m\u00e1s inteligente, extrayendo y consolidando la l\u00f3gica de tama\u00f1o de la versi\u00f3n de la parte en un ayudante com\u00fan, en lugar de forzar la asignaci\u00f3n m\u00e1s grande posible. Sin embargo, por ahora esto funciona y corrige la escritura fuera de los l\u00edmites. v2: * Se elimina el caso imposible de v3_0. (Mario) (seleccionado de el commit 0880f58f9609f0200483a49429af0f050d281703)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"41cec40bc9baba83d36a0718ea94bfe63189274a\",\"lessThan\":\"f111de0f010308949254ee1cc45df8e6b8e1d7d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41cec40bc9baba83d36a0718ea94bfe63189274a\",\"lessThan\":\"f8fd9f0d57af4f8f48b383ec28287af85b47cb9f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41cec40bc9baba83d36a0718ea94bfe63189274a\",\"lessThan\":\"4aa923a6e6406b43566ef6ac35a3d9a3197fa3e8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.63\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.7\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-12-11T15:09:21.051694Z\",\"id\":\"CVE-2024-50221\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.11.7\",\"matchCriteriaId\":\"BB85C4DB-9954-4405-B9F2-B57ED43DA8E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4aa923a6e6406b43566ef6ac35a3d9a3197fa3e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f111de0f010308949254ee1cc45df8e6b8e1d7d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f8fd9f0d57af4f8f48b383ec28287af85b47cb9f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:20:33+00:00",
      "cve": "CVE-2024-50221",
      "id": "CVE-2024-50221",
      "initial_release_date": "2024-11-09T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amd/pm: Vangogh: Fix kernel memory out of bounds write",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50221.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50221\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-11T15:09:21.051694Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-11T15:10:09.954Z\"}}], \"cna\": {\"title\": \"drm/amd/pm: Vangogh: Fix kernel memory out of bounds write\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"41cec40bc9baba83d36a0718ea94bfe63189274a\", \"lessThan\": \"f111de0f010308949254ee1cc45df8e6b8e1d7d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41cec40bc9baba83d36a0718ea94bfe63189274a\", \"lessThan\": \"f8fd9f0d57af4f8f48b383ec28287af85b47cb9f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41cec40bc9baba83d36a0718ea94bfe63189274a\", \"lessThan\": \"4aa923a6e6406b43566ef6ac35a3d9a3197fa3e8\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.63\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f111de0f010308949254ee1cc45df8e6b8e1d7d4\"}, {\"url\": \"https://git.kernel.org/stable/c/f8fd9f0d57af4f8f48b383ec28287af85b47cb9f\"}, {\"url\": \"https://git.kernel.org/stable/c/4aa923a6e6406b43566ef6ac35a3d9a3197fa3e8\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/pm: Vangogh: Fix kernel memory out of bounds write\\n\\nKASAN reports that the GPU metrics table allocated in\\nvangogh_tables_init() is not large enough for the memset done in\\nsmu_cmn_init_soft_gpu_metrics(). Condensed report follows:\\n\\n[   33.861314] BUG: KASAN: slab-out-of-bounds in smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu]\\n[   33.861799] Write of size 168 at addr ffff888129f59500 by task mangoapp/1067\\n...\\n[   33.861808] CPU: 6 UID: 1000 PID: 1067 Comm: mangoapp Tainted: G        W          6.12.0-rc4 #356 1a56f59a8b5182eeaf67eb7cb8b13594dd23b544\\n[   33.861816] Tainted: [W]=WARN\\n[   33.861818] Hardware name: Valve Galileo/Galileo, BIOS F7G0107 12/01/2023\\n[   33.861822] Call Trace:\\n[   33.861826]  \u003cTASK\u003e\\n[   33.861829]  dump_stack_lvl+0x66/0x90\\n[   33.861838]  print_report+0xce/0x620\\n[   33.861853]  kasan_report+0xda/0x110\\n[   33.862794]  kasan_check_range+0xfd/0x1a0\\n[   33.862799]  __asan_memset+0x23/0x40\\n[   33.862803]  smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\\n[   33.863306]  vangogh_get_gpu_metrics_v2_4+0x123/0xad0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\\n[   33.864257]  vangogh_common_get_gpu_metrics+0xb0c/0xbc0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\\n[   33.865682]  amdgpu_dpm_get_gpu_metrics+0xcc/0x110 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\\n[   33.866160]  amdgpu_get_gpu_metrics+0x154/0x2d0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\\n[   33.867135]  dev_attr_show+0x43/0xc0\\n[   33.867147]  sysfs_kf_seq_show+0x1f1/0x3b0\\n[   33.867155]  seq_read_iter+0x3f8/0x1140\\n[   33.867173]  vfs_read+0x76c/0xc50\\n[   33.867198]  ksys_read+0xfb/0x1d0\\n[   33.867214]  do_syscall_64+0x90/0x160\\n...\\n[   33.867353] Allocated by task 378 on cpu 7 at 22.794876s:\\n[   33.867358]  kasan_save_stack+0x33/0x50\\n[   33.867364]  kasan_save_track+0x17/0x60\\n[   33.867367]  __kasan_kmalloc+0x87/0x90\\n[   33.867371]  vangogh_init_smc_tables+0x3f9/0x840 [amdgpu]\\n[   33.867835]  smu_sw_init+0xa32/0x1850 [amdgpu]\\n[   33.868299]  amdgpu_device_init+0x467b/0x8d90 [amdgpu]\\n[   33.868733]  amdgpu_driver_load_kms+0x19/0xf0 [amdgpu]\\n[   33.869167]  amdgpu_pci_probe+0x2d6/0xcd0 [amdgpu]\\n[   33.869608]  local_pci_probe+0xda/0x180\\n[   33.869614]  pci_device_probe+0x43f/0x6b0\\n\\nEmpirically we can confirm that the former allocates 152 bytes for the\\ntable, while the latter memsets the 168 large block.\\n\\nRoot cause appears that when GPU metrics tables for v2_4 parts were added\\nit was not considered to enlarge the table to fit.\\n\\nThe fix in this patch is rather \\\"brute force\\\" and perhaps later should be\\ndone in a smarter way, by extracting and consolidating the part version to\\nsize logic to a common helper, instead of brute forcing the largest\\npossible allocation. Nevertheless, for now this works and fixes the out of\\nbounds write.\\n\\nv2:\\n * Drop impossible v3_0 case. (Mario)\\n\\n(cherry picked from commit 0880f58f9609f0200483a49429af0f050d281703)\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.63\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.7\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:49:05.636Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50221\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:49:05.636Z\", \"dateReserved\": \"2024-10-21T19:36:19.973Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-09T10:14:32.390Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.