CVEvulnerability
CVE-2024-50187
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2024-11-08
- Last modified
- 2026-08-04
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- CVSS 3.1 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Description
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Stop the active perfmon before being destroyed
Upon closing the file descriptor, the active performance monitor is not
stopped. Although all perfmons are destroyed in `vc4_perfmon_close_file()`,
the active performance monitor's pointer (`vc4->active_perfmon`) is still
retained.
If we open a new file descriptor and submit a few jobs with performance
monitors, the driver will attempt to stop the active performance monitor
using the stale pointer in `vc4->active_perfmon`. However, this pointer
is no longer valid because the previous process has already terminated,
and all performance monitors associated with it have been destroyed and
freed.
To fix this, when the active performance monitor belongs to a given
process, explicitly stop it before destroying and freeing it.
Affected configurations
• linux linux kernel (>= 4.17 < 6.1.113)
• linux linux kernel (>= 6.2 < 6.6.57)
• linux linux kernel (>= 6.7 < 6.11.4)
• linux linux kernel 6.12
References
- https://git.kernel.org/stable/c/0b2ad4f6f2bec74a5287d96cb2325a5e11706f22 Patch
- https://git.kernel.org/stable/c/75452da51e2403e14be007df80d133e1443fc967 Patch
- https://git.kernel.org/stable/c/937943c042503dc6087438bf3557f9057a588ba0 Patch
- https://git.kernel.org/stable/c/c9adba739d5f7cdc47a7754df4a17b47b1ecf513 Patch
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html lists.debian.org