Linux kernel (drivers/gpu/drm/nouveau/nvkm/subdev/gsp): The GSP message-queue read pointer is advanced by the wrong

CVSS 7.8CVE-2024-58019NVIDIA / GPU stackcurated

Impact

The GSP message-queue read pointer is advanced by the wrong amount, so the driver parses message body bytes as a header, underflows the copy-length computation to a ~0xffffffff value and then dereferences a NULL message pointer. Oversized copy plus kernel panic - the node goes down for every tenant sharing it.

Who can reach it

Same GSP RPC path as CVE-2024-58018: two-page GSP event messages generated during normal tenant-driven GPU activity on a nouveau/GSP-firmware NVIDIA GPU. A tenant holding /dev/dri/renderD* supplies the workload that produces those messages; no capabilities required. Not applicable when the NVIDIA vendor module is in use.

What to do

Update to a kernel carrying the fix (stable commits below; no fixed_in published). Interim: run the vendor kernel module rather than nouveau on shared GSP-class GPUs.

References

https://git.kernel.org/stable/c/5185e63b45ea39339ed83f269e2ddfafb07e70d9 https://git.kernel.org/stable/c/67c9cf82f50236d9c000333b26b4f95eb2c3e1b2 https://nvd.nist.gov/vuln/detail/CVE-2024-58019

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.