Database/Kernel, userspace & hypervisor
Linux kernel (drivers/gpu/drm/xe): The Xe VRAM manager computed a buffer object's minimum page size by shifting a
Impact
The Xe VRAM manager computed a buffer object's minimum page size by shifting a 32-bit alignment value, which overflows before it is stored into a 64-bit field. A tenant that requests a large page alignment gets a wrong, truncated minimum size back into the VRAM allocator, which is how allocations end up smaller or worse-aligned than the driver believes - the setup for one tenant's buffer overlapping memory the allocator considers someone else's.
Who can reach it
Reachable from a container holding /dev/dri/renderD* on an Intel Xe node through ordinary buffer-object creation with attacker-chosen size and alignment; the overflow is in the TTM VRAM manager's allocation path, so no special ioctl or privilege is needed.
What to do
Boot a kernel containing the fix commits below. No practical interim control other than withholding render-node access from untrusted tenants.
References
Related entries
- Linux kernel (drivers/gpu/drm/xe): Freeing a scheduler job dereferences the VM it belongs to, but the final exec-queueCVE-2024-44978 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): The preempt-fence lock lives inside the exec queue, but the queue reference isCVE-2024-46683 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): The per-client memory accounting walks buffer-object state (TTM resource, tt pages)CVE-2024-46866 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): The GPU VM is published into the id table before the create ioctl finishes with itCVE-2024-49865 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): The observation/OA path reuses one batch buffer and appends a batch-end command onCVE-2024-50090 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): Xe freed a job from inside timeout-detection-and-recovery while the submissionCVE-2024-50149 · Linux kernel (drivers/gpu/drm/xe)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.