Linux kernel (drivers/gpu/drm/nouveau/nvkm/core): Nouveau's per-client object tree had no locking at all, so concurrent

CVSS 7.8CVE-2024-27062Kernel, userspace & hypervisorcurated

Impact

Nouveau's per-client object tree had no locking at all, so concurrent object creation and destruction - most visibly VRAM BAR mappings - corrupts the tree. The reported crash is a general protection fault on a wild pointer during object lookup, which is the signature of an attacker-influenceable dangling pointer in the object namespace that backs GPU memory mappings.

Who can reach it

An unprivileged multi-threaded process in a container holding /dev/dri/renderD* on a nouveau-driven GPU races object allocation against object free; the crash was reproduced by a plain Vulkan conformance run, so no exotic ioctl sequence is needed. Conditional on the open nouveau driver being the one bound to the GPU.

What to do

Update to a kernel with the fix commits below, which adds locking around the client object tree. Interim: blacklist nouveau where the proprietary NVIDIA driver is used, and otherwise keep /dev/dri away from untrusted tenants.

References

https://git.kernel.org/stable/c/6887314f5356389fc219b8152e951ac084a10ef7 https://git.kernel.org/stable/c/96c8751844171af4b3898fee3857ee180586f589 https://nvd.nist.gov/vuln/detail/CVE-2024-27062

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.