Linux kernel (drivers/gpu/drm/nouveau/nvkm/subdev/gsp): The driver miscalculates free space in the GSP firmware command

CVSS 5.5CVE-2024-58018NVIDIA / GPU stackcurated

Impact

The driver miscalculates free space in the GSP firmware command ring when the write pointer wraps, and overwrites the RPC the GPU firmware is still reading. The firmware wedges on a corrupted request and the GPU is dead for every tenant on it until the node is rebooted.

Who can reach it

Indirect but tenant-driven: any tenant holding /dev/dri/renderD* on a GSP-firmware NVIDIA GPU under nouveau generates the RPC traffic (allocations, mappings, large requests) that wraps the ring, and a tenant issuing large or high-volume allocations makes the wrap case likely. Only applies where nouveau with GSP-RM is the driver, not the NVIDIA proprietary/open kernel module.

What to do

Update to a kernel carrying the fix (stable commits below; no fixed_in published). Interim: run the vendor kernel module rather than nouveau on shared GSP-class GPUs.

References

https://git.kernel.org/stable/c/56e6c7f6d2a6b4e0aae0528c502e56825bb40598 https://git.kernel.org/stable/c/6b6b75728c86f60c1fc596f0d4542427d0e6065b https://nvd.nist.gov/vuln/detail/CVE-2024-58018

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.