CVE-2024-52559

drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

State: Published
Severity: 7.8 High
Published: Feb 27, 2025
Updated: Oct 30, 2026
Reserved: Feb 27, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32 values that come from the user via the submit_lookup_cmds() function. This addition could lead to an integer wrapping bug so use size_add() to prevent that.

Patchwork: https://patchwork.freedesktop.org/patch/624696/

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	198725337ef1f73b73e7dc953c6ffb0799f26ffe to before e6a1565f5edacc37a82f12810566b8f6d73c33e5Affected 198725337ef1f73b73e7dc953c6ffb0799f26ffe to before 2b99b2c4621d13bd4374ef384e8f1fc188d0a5dfAffected 198725337ef1f73b73e7dc953c6ffb0799f26ffe to before 2f1845e46c41ed500789d53dc45b383b7745c96cAffected 198725337ef1f73b73e7dc953c6ffb0799f26ffe to before e43a0f1327a1ee70754f8a0de6e0262cfa3e0b87Affected 198725337ef1f73b73e7dc953c6ffb0799f26ffe to before 3a47f4b439beb98e955d501c609dfd12b7836d61Affected
LinuxLinux	3.12Affected before 3.12Not affected 6.1.191 through 6.1.Not affected 6.6.80 through 6.6.Not affected 6.12.16 through 6.12.Not affected 6.13.4 through 6.13.Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

198725337ef1f73b73e7dc953c6ffb0799f26ffe to before e6a1565f5edacc37a82f12810566b8f6d73c33e5Affected
198725337ef1f73b73e7dc953c6ffb0799f26ffe to before 2b99b2c4621d13bd4374ef384e8f1fc188d0a5dfAffected
198725337ef1f73b73e7dc953c6ffb0799f26ffe to before 2f1845e46c41ed500789d53dc45b383b7745c96cAffected
198725337ef1f73b73e7dc953c6ffb0799f26ffe to before e43a0f1327a1ee70754f8a0de6e0262cfa3e0b87Affected
198725337ef1f73b73e7dc953c6ffb0799f26ffe to before 3a47f4b439beb98e955d501c609dfd12b7836d61Affected

LinuxLinux

3.12Affected
before 3.12Not affected
6.1.191 through 6.1.*Not affected
6.6.80 through 6.6.*Not affected
6.12.16 through 6.12.*Not affected
6.13.4 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.