CVE-2024-46896

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-46896
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't access invalid sched Since 2320c9e6a768 ("drm/sched: memset() 'job' in drm_sched_job_init()") accessing job->base.sched can produce unexpected results as the initialisation of (*job)->base.sched done in amdgpu_job_alloc is overwritten by the memset. This commit fixes an issue when a CS would fail validation and would be rejected after job->num_ibs is incremented. In this case, amdgpu_ib_free(ring->adev, ...) will be called, which would crash the machine because the ring value is bogus. To fix this, pass a NULL pointer to amdgpu_ib_free(): we can do this because the device is actually not used in this function. The next commit will remove the ring argument completely. (cherry picked from commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7)

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/65501a4fd84ecdc0af863dbb37759242aab9f2dd Patch
https://git.kernel.org/stable/c/67291d601f2b032062b1b2f60ffef1b63e10094c Patch
https://git.kernel.org/stable/c/a93b1020eb9386d7da11608477121b10079c076a Patch
https://git.kernel.org/stable/c/da6b2c626ae73c303378ce9eaf6e3eaf16c9925a Patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
History

03 Nov 2025, 21:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html -

23 Sep 2025, 16:29

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/65501a4fd84ecdc0af863dbb37759242aab9f2dd - () https://git.kernel.org/stable/c/65501a4fd84ecdc0af863dbb37759242aab9f2dd - Patch
References () https://git.kernel.org/stable/c/67291d601f2b032062b1b2f60ffef1b63e10094c - () https://git.kernel.org/stable/c/67291d601f2b032062b1b2f60ffef1b63e10094c - Patch
References () https://git.kernel.org/stable/c/a93b1020eb9386d7da11608477121b10079c076a - () https://git.kernel.org/stable/c/a93b1020eb9386d7da11608477121b10079c076a - Patch
References () https://git.kernel.org/stable/c/da6b2c626ae73c303378ce9eaf6e3eaf16c9925a - () https://git.kernel.org/stable/c/da6b2c626ae73c303378ce9eaf6e3eaf16c9925a - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdgpu: no acceder a sched no válido Desde 2320c9e6a768 ("drm/sched: memset() 'job' en drm_sched_job_init()") acceder a job->base.sched puede producir resultados inesperados ya que la inicialización de (*job)->base.sched realizada en amdgpu_job_alloc es sobrescrita por memset. Esta confirmación corrige un problema cuando un CS fallaría la validación y sería rechazado después de que se incremente job->num_ibs. En este caso, se llamará a amdgpu_ib_free(ring->adev, ...), lo que bloquearía la máquina porque el valor de ring es falso. Para corregir esto, pase un puntero NULL a amdgpu_ib_free(): podemos hacer esto porque el dispositivo en realidad no se usa en esta función. La próxima confirmación eliminará el argumento ring por completo. (seleccionado del commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7)
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*

11 Jan 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-11 13:15

Updated : 2025-11-03 21:16

NVD link : CVE-2024-46896

Mitre link : CVE-2024-46896

CVE.ORG link : CVE-2024-46896

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference