Vulnerability-Lookup

GHSA-QFXC-FJVG-2QGM

Vulnerability from github – Published: 2024-09-13 09:30 – Updated: 2024-09-19 15:30

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: reset mmio mappings with devm

Set our various mmio mappings to NULL. This should make it easier to catch something rogue trying to mess with mmio after device removal. For example, we might unmap everything and then start hitting some mmio address which has already been unmamped by us and then remapped by something else, causing all kinds of carnage.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-46705"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-13T07:15:05Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: reset mmio mappings with devm\n\nSet our various mmio mappings to NULL. This should make it easier to\ncatch something rogue trying to mess with mmio after device removal. For\nexample, we might unmap everything and then start hitting some mmio\naddress which has already been unmamped by us and then remapped by\nsomething else, causing all kinds of carnage.",
  "id": "GHSA-qfxc-fjvg-2qgm",
  "modified": "2024-09-19T15:30:49Z",
  "published": "2024-09-13T09:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46705"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b1c9fbed3884d3883021d699c7cdf5253a65543a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c7117419784f612d59ee565145f722e8b5541fe6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-46705 (GCVE-0-2024-46705)

Vulnerability from cvelistv5 – Published: 2024-09-13 06:27 – Updated: 2026-08-05 11:38

Title

drm/xe: reset mmio mappings with devm

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/xe: reset mmio mappings with devm Set our various mmio mappings to NULL. This should make it easier to catch something rogue trying to mess with mmio after device removal. For example, we might unmap everything and then start hitting some mmio address which has already been unmamped by us and then remapped by something else, causing all kinds of carnage.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-29 15:03 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6637 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/b1c9fbed3884d3883…
https://git.kernel.org/stable/c/c7117419784f612d5…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: dd08ebf6c3525a7ea2186e636df064ea47281987 , < b1c9fbed3884d3883021d699c7cdf5253a65543a (git) Affected: dd08ebf6c3525a7ea2186e636df064ea47281987 , < c7117419784f612d59ee565145f722e8b5541fe6 (git)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.10.7 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:03:07.858976Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:03:22.407Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_device.c",
            "drivers/gpu/drm/xe/xe_mmio.c",
            "drivers/gpu/drm/xe/xe_mmio.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b1c9fbed3884d3883021d699c7cdf5253a65543a",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            },
            {
              "lessThan": "c7117419784f612d59ee565145f722e8b5541fe6",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_device.c",
            "drivers/gpu/drm/xe/xe_mmio.c",
            "drivers/gpu/drm/xe/xe_mmio.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: reset mmio mappings with devm\n\nSet our various mmio mappings to NULL. This should make it easier to\ncatch something rogue trying to mess with mmio after device removal. For\nexample, we might unmap everything and then start hitting some mmio\naddress which has already been unmamped by us and then remapped by\nsomething else, causing all kinds of carnage."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The dangling MMIO/GGTT mappings are dereferenced from `drm/xe` ioctl paths on `/dev/dri/renderD*` and from driver worker/teardown code, so the attack is delivered through local device-node access. No network or remote protocol handling is involved.\nAC:L - An attacker holding an open render node fd can continuously drive GGTT-insert and MMIO traffic, keeping the race window saturated across the device-removal event, and can trigger the removal side themselves on a hot-pluggable/Thunderbolt eGPU. This is a use-after-free-class defect where the attacker participates in both sides of the race.\nPR:L - All xe ioctls are marked `DRM_RENDER_ALLOW`, so an unprivileged local user in the standard `render`/`video` group \u2014 the default on desktops and inside many GPU-enabled containers \u2014 reaches `xe_ggtt_map_bo()` and the `xe_mmio_*` accessors. No CAP_SYS_ADMIN or root is needed to dereference the stale pointers.\nUI:N - The stale mappings are hit by the attacker\u0027s own ioctl stream and by the driver\u0027s asynchronous teardown/worker paths; no separate victim action is required, and on an eGPU/dock system the removal event itself is an action the attacker performs.\nS:U - The dangling iomem access and its consequences remain within the kernel\u0027s own security authority. There is no hypervisor or IOMMU boundary crossed by the defect itself.\nC:H - Reads through the stale `tile-\u003emmio.regs`, `tile-\u003emmio_ext.regs`, or `tile-\u003emem.vram.mapping` alias return the contents of whatever device BAR has since been re-`ioremap()`\u0027d into that virtual range, and those values are returned to userspace through query/debugfs paths \u2014 an unbounded cross-device information disclosure.\nI:H - `xe_ggtt_set_pte()` performs an attacker-influenced 64-bit `writeq()` at an attacker-influenced offset within an 8 MB window through the dangling `ggtt-\u003egsm` alias, letting the attacker reprogram another PCI device\u0027s control registers, which is further leveragable into DMA-based arbitrary memory writes.\nA:H - Touching an already-unmapped iomem virtual address after `pci_iounmap()`/`iounmap()` faults in kernel context and oopses, and corrupting an unrelated device\u0027s registers reliably wedges or panics the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:03.120Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b1c9fbed3884d3883021d699c7cdf5253a65543a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7117419784f612d59ee565145f722e8b5541fe6"
        }
      ],
      "title": "drm/xe: reset mmio mappings with devm",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46705",
    "datePublished": "2024-09-13T06:27:32.455Z",
    "dateReserved": "2024-09-11T15:12:18.251Z",
    "dateUpdated": "2026-08-05T11:38:03.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted