Riskcovery

CVE-2024-50090

drm/xe/oa: Fix overflow in oa batch buffer

State
Published
Severity
7.8 High
Published
Nov 5, 2024
Updated
Aug 5, 2026
Reserved
Oct 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/oa: Fix overflow in oa batch buffer

By default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch buffer, this is not a problem if batch buffer is only used once but oa reuses the batch buffer for the same metric and at each call it appends a MI_BATCH_BUFFER_END, printing the warning below and then overflowing.

[ 381.072016] ------------[ cut here ]------------ [ 381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed! platform: LUNARLAKE subplatform: 1 graphics: Xe2_LPG / Xe2_HPG 20.04 step B0 media: Xe2_LPM / Xe2_HPM 20.00 step B0 tile: 0 VRAM 0 B GT: 0 type 1

So here checking if batch buffer already have MI_BATCH_BUFFER_END if not append it.

v2: - simply fix, suggestion from Ashutosh

(cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected Products

ProductVersions
LinuxLinux
  • dd08ebf6c3525a7ea2186e636df064ea47281987 to before bcb5be3421705e682b0b32073ad627056d6bc2a2Affected
  • dd08ebf6c3525a7ea2186e636df064ea47281987 to before 6c10ba06bb1b48acce6d4d9c1e33beb9954f1788Affected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.11.4 through 6.11.*Not affected
  • 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.