Linux kernel (drivers/gpu/drm/nouveau): When the device-to-host copy behind a page fault silently fails, the fault

CVSS 7.3CVE-2024-50096Kernel, userspace & hypervisorcurated

Impact

When the device-to-host copy behind a page fault silently fails, the fault handler still hands the process a HIGH_USER page that was never written. The tenant reads whatever was previously in that page - residual data from other workloads on the node. This is the cross-tenant information-disclosure case, and the upstream fix calls it a security vulnerability in those words.

Who can reach it

Tenant holding /dev/dri/renderD* on nouveau using SVM/HMM device memory: fault a migrated page back to host RAM while the copy engine fails (a hung or erroring GPU, itself tenant-inducible). No capabilities required. nouveau device-memory (dmem) path only.

What to do

Update to a kernel carrying the fix (stable commits below; no fixed_in published). Interim: disable SVM/HMM device memory on nouveau nodes, or do not share nouveau GPUs across tenants.

References

https://git.kernel.org/stable/c/fd9bb7e996bab9b9049fffe3f3d3b50dee191d27 https://git.kernel.org/stable/c/73f75d2b5aee5a735cf64b8ab4543d5c20dbbdd9 https://nvd.nist.gov/vuln/detail/CVE-2024-50096

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.