Vulnerability-Lookup

CVE-2024-41008 (GCVE-0-2024-41008)

Vulnerability from cvelistv5 – Published: 2024-07-16 08:03 – Updated: 2026-05-11 20:24

Title

drm/amdgpu: change vm->task_info handling

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: change vm->task_info handling This patch changes the handling and lifecycle of vm->task_info object. The major changes are: - vm->task_info is a dynamically allocated ptr now, and its uasge is reference counted. - introducing two new helper funcs for task_info lifecycle management - amdgpu_vm_get_task_info: reference counts up task_info before returning this info - amdgpu_vm_put_task_info: reference counts down task_info - last put to task_info() frees task_info from the vm. This patch also does logistical changes required for existing usage of vm->task_info. V2: Do not block all the prints when task_info not found (Felix) V3: Fixed review comments from Felix - Fix wrong indentation - No debug message for -ENOMEM - Add NULL check for task_info - Do not duplicate the debug messages (ti vs no ti) - Get first reference of task_info in vm_init(), put last in vm_fini() V4: Fixed review comments from Felix - fix double reference increment in create_task_info - change amdgpu_vm_get_task_info_pasid - additional changes in amdgpu_gem.c while porting

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

Assigner

Linux

References

1 reference

URL	Tags
https://git.kernel.org/stable/c/b8f67b9ddf4f8fe6d…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < b8f67b9ddf4f8fe6dd536590712b5912ad78f99c (git)
Linux	Linux	Affected: 4.2 Unaffected: 0 , < 4.2 (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:39:56.069Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b8f67b9ddf4f8fe6dd536590712b5912ad78f99c"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41008",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:00:49.381223Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:18.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_job.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_reset.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c",
            "drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c",
            "drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c",
            "drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c",
            "drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c",
            "drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c",
            "drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c",
            "drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b8f67b9ddf4f8fe6dd536590712b5912ad78f99c",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_job.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_reset.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c",
            "drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c",
            "drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c",
            "drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c",
            "drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c",
            "drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c",
            "drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c",
            "drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: change vm-\u003etask_info handling\n\nThis patch changes the handling and lifecycle of vm-\u003etask_info object.\nThe major changes are:\n- vm-\u003etask_info is a dynamically allocated ptr now, and its uasge is\n  reference counted.\n- introducing two new helper funcs for task_info lifecycle management\n    - amdgpu_vm_get_task_info: reference counts up task_info before\n      returning this info\n    - amdgpu_vm_put_task_info: reference counts down task_info\n- last put to task_info() frees task_info from the vm.\n\nThis patch also does logistical changes required for existing usage\nof vm-\u003etask_info.\n\nV2: Do not block all the prints when task_info not found (Felix)\n\nV3: Fixed review comments from Felix\n   - Fix wrong indentation\n   - No debug message for -ENOMEM\n   - Add NULL check for task_info\n   - Do not duplicate the debug messages (ti vs no ti)\n   - Get first reference of task_info in vm_init(), put last\n     in vm_fini()\n\nV4: Fixed review comments from Felix\n   - fix double reference increment in create_task_info\n   - change amdgpu_vm_get_task_info_pasid\n   - additional changes in amdgpu_gem.c while porting"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:24:14.890Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b8f67b9ddf4f8fe6dd536590712b5912ad78f99c"
        }
      ],
      "title": "drm/amdgpu: change vm-\u003etask_info handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41008",
    "datePublished": "2024-07-16T08:03:47.091Z",
    "dateReserved": "2024-07-12T12:17:45.610Z",
    "dateUpdated": "2026-05-11T20:24:14.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-41008",
      "date": "2026-07-21",
      "epss": "0.0018",
      "percentile": "0.0771"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: change vm-\u003etask_info handling\\n\\nThis patch changes the handling and lifecycle of vm-\u003etask_info object.\\nThe major changes are:\\n- vm-\u003etask_info is a dynamically allocated ptr now, and its uasge is\\n  reference counted.\\n- introducing two new helper funcs for task_info lifecycle management\\n    - amdgpu_vm_get_task_info: reference counts up task_info before\\n      returning this info\\n    - amdgpu_vm_put_task_info: reference counts down task_info\\n- last put to task_info() frees task_info from the vm.\\n\\nThis patch also does logistical changes required for existing usage\\nof vm-\u003etask_info.\\n\\nV2: Do not block all the prints when task_info not found (Felix)\\n\\nV3: Fixed review comments from Felix\\n   - Fix wrong indentation\\n   - No debug message for -ENOMEM\\n   - Add NULL check for task_info\\n   - Do not duplicate the debug messages (ti vs no ti)\\n   - Get first reference of task_info in vm_init(), put last\\n     in vm_fini()\\n\\nV4: Fixed review comments from Felix\\n   - fix double reference increment in create_task_info\\n   - change amdgpu_vm_get_task_info_pasid\\n   - additional changes in amdgpu_gem.c while porting\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdgpu: cambiar el manejo de vm-\u0026gt;task_info Este parche cambia el manejo y el ciclo de vida del objeto vm-\u0026gt;task_info. Los cambios principales son: - vm-\u0026gt;task_info ahora es un ptr asignado din\\u00e1micamente y su uso se cuenta por referencia. - presentamos dos nuevas funciones auxiliares para la gesti\\u00f3n del ciclo de vida de task_info - amdgpu_vm_get_task_info: la referencia cuenta task_info antes de devolver esta informaci\\u00f3n - amdgpu_vm_put_task_info: la referencia cuenta atr\\u00e1s task_info - la \\u00faltima entrada en task_info() libera task_info de la m\\u00e1quina virtual. Este parche tambi\\u00e9n realiza cambios log\\u00edsticos necesarios para el uso existente de vm-\u0026gt;task_info. V2: No bloquear todas las impresiones cuando no se encuentra task_info (Felix) V3: Se corrigieron los comentarios de revisi\\u00f3n de Felix - Se corrigi\\u00f3 la sangr\\u00eda incorrecta - No hay mensaje de depuraci\\u00f3n para -ENOMEM - Agregar verificaci\\u00f3n NULL para task_info - No se duplican los mensajes de depuraci\\u00f3n (ti vs no ti) - Obtenga la primera referencia de task_info en vm_init(), col\\u00f3quela \\u00faltima en vm_fini() V4: Se corrigieron los comentarios de revisi\\u00f3n de Felix - se corrigi\\u00f3 el incremento de doble referencia en create_task_info - se cambi\\u00f3 amdgpu_vm_get_task_info_pasid - cambios adicionales en amdgpu_gem.c durante la portabilidad\"}]",
      "id": "CVE-2024-41008",
      "lastModified": "2024-11-21T09:32:03.360",
      "published": "2024-07-16T08:15:02.240",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/b8f67b9ddf4f8fe6dd536590712b5912ad78f99c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b8f67b9ddf4f8fe6dd536590712b5912ad78f99c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:59:40.000Z",
      "cve": "CVE-2024-41008",
      "id": "msrc_CVE-2024-41008",
      "initial_release_date": "2024-07-01T07:00:00.000Z",
      "product_status:known_affected": "17",
      "product_status:under_investigation": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amdgpu: change vm-\u003etask_info handling",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-41008.json",
      "version": "15"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41008\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-16T08:15:02.240\",\"lastModified\":\"2026-06-17T07:47:04.560\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: change vm-\u003etask_info handling\\n\\nThis patch changes the handling and lifecycle of vm-\u003etask_info object.\\nThe major changes are:\\n- vm-\u003etask_info is a dynamically allocated ptr now, and its uasge is\\n  reference counted.\\n- introducing two new helper funcs for task_info lifecycle management\\n    - amdgpu_vm_get_task_info: reference counts up task_info before\\n      returning this info\\n    - amdgpu_vm_put_task_info: reference counts down task_info\\n- last put to task_info() frees task_info from the vm.\\n\\nThis patch also does logistical changes required for existing usage\\nof vm-\u003etask_info.\\n\\nV2: Do not block all the prints when task_info not found (Felix)\\n\\nV3: Fixed review comments from Felix\\n   - Fix wrong indentation\\n   - No debug message for -ENOMEM\\n   - Add NULL check for task_info\\n   - Do not duplicate the debug messages (ti vs no ti)\\n   - Get first reference of task_info in vm_init(), put last\\n     in vm_fini()\\n\\nV4: Fixed review comments from Felix\\n   - fix double reference increment in create_task_info\\n   - change amdgpu_vm_get_task_info_pasid\\n   - additional changes in amdgpu_gem.c while porting\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdgpu: cambiar el manejo de vm-\u0026gt;task_info Este parche cambia el manejo y el ciclo de vida del objeto vm-\u0026gt;task_info. Los cambios principales son: - vm-\u0026gt;task_info ahora es un ptr asignado din\u00e1micamente y su uso se cuenta por referencia. - presentamos dos nuevas funciones auxiliares para la gesti\u00f3n del ciclo de vida de task_info - amdgpu_vm_get_task_info: la referencia cuenta task_info antes de devolver esta informaci\u00f3n - amdgpu_vm_put_task_info: la referencia cuenta atr\u00e1s task_info - la \u00faltima entrada en task_info() libera task_info de la m\u00e1quina virtual. Este parche tambi\u00e9n realiza cambios log\u00edsticos necesarios para el uso existente de vm-\u0026gt;task_info. V2: No bloquear todas las impresiones cuando no se encuentra task_info (Felix) V3: Se corrigieron los comentarios de revisi\u00f3n de Felix - Se corrigi\u00f3 la sangr\u00eda incorrecta - No hay mensaje de depuraci\u00f3n para -ENOMEM - Agregar verificaci\u00f3n NULL para task_info - No se duplican los mensajes de depuraci\u00f3n (ti vs no ti) - Obtenga la primera referencia de task_info en vm_init(), col\u00f3quela \u00faltima en vm_fini() V4: Se corrigieron los comentarios de revisi\u00f3n de Felix - se corrigi\u00f3 el incremento de doble referencia en create_task_info - se cambi\u00f3 amdgpu_vm_get_task_info_pasid - cambios adicionales en amdgpu_gem.c durante la portabilidad\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c\",\"drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c\",\"drivers/gpu/drm/amd/amdgpu/amdgpu_job.c\",\"drivers/gpu/drm/amd/amdgpu/amdgpu_reset.c\",\"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c\",\"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h\",\"drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c\",\"drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c\",\"drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c\",\"drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c\",\"drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c\",\"drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c\",\"drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c\",\"drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"b8f67b9ddf4f8fe6dd536590712b5912ad78f99c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c\",\"drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c\",\"drivers/gpu/drm/amd/amdgpu/amdgpu_job.c\",\"drivers/gpu/drm/amd/amdgpu/amdgpu_reset.c\",\"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c\",\"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h\",\"drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c\",\"drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c\",\"drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c\",\"drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c\",\"drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c\",\"drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c\",\"drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c\",\"drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:00:49.381223Z\",\"id\":\"CVE-2024-41008\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2\",\"versionEndExcluding\":\"6.9\",\"matchCriteriaId\":\"E6BD4683-0AAB-43D1-B079-A0C20DE05CF6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b8f67b9ddf4f8fe6dd536590712b5912ad78f99c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b8f67b9ddf4f8fe6dd536590712b5912ad78f99c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:16:29+00:00",
      "cve": "CVE-2024-41008",
      "id": "CVE-2024-41008",
      "initial_release_date": "2024-07-16T00:00:00+00:00",
      "product_status:fixed": "709",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "22",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdgpu: change vm-\u0026gt;task_info handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-41008.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2025-12-13T00:38:37Z",
      "cve": "CVE-2024-41008",
      "id": "CVE-2024-41008",
      "initial_release_date": "2024-07-19T02:37:14Z",
      "product_status:recommended": "79",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-41008",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-41008.json",
      "version": "31"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b8f67b9ddf4f8fe6dd536590712b5912ad78f99c\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:39:56.069Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41008\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:00:49.381223Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:21.879Z\"}}], \"cna\": {\"title\": \"drm/amdgpu: change vm-\u003etask_info handling\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\", \"lessThan\": \"b8f67b9ddf4f8fe6dd536590712b5912ad78f99c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c\", \"drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c\", \"drivers/gpu/drm/amd/amdgpu/amdgpu_job.c\", \"drivers/gpu/drm/amd/amdgpu/amdgpu_reset.c\", \"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c\", \"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h\", \"drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c\", \"drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c\", \"drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c\", \"drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c\", \"drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c\", \"drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c\", \"drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c\", \"drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c\", \"drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c\", \"drivers/gpu/drm/amd/amdgpu/amdgpu_job.c\", \"drivers/gpu/drm/amd/amdgpu/amdgpu_reset.c\", \"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c\", \"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h\", \"drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c\", \"drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c\", \"drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c\", \"drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c\", \"drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c\", \"drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c\", \"drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c\", \"drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b8f67b9ddf4f8fe6dd536590712b5912ad78f99c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: change vm-\u003etask_info handling\\n\\nThis patch changes the handling and lifecycle of vm-\u003etask_info object.\\nThe major changes are:\\n- vm-\u003etask_info is a dynamically allocated ptr now, and its uasge is\\n  reference counted.\\n- introducing two new helper funcs for task_info lifecycle management\\n    - amdgpu_vm_get_task_info: reference counts up task_info before\\n      returning this info\\n    - amdgpu_vm_put_task_info: reference counts down task_info\\n- last put to task_info() frees task_info from the vm.\\n\\nThis patch also does logistical changes required for existing usage\\nof vm-\u003etask_info.\\n\\nV2: Do not block all the prints when task_info not found (Felix)\\n\\nV3: Fixed review comments from Felix\\n   - Fix wrong indentation\\n   - No debug message for -ENOMEM\\n   - Add NULL check for task_info\\n   - Do not duplicate the debug messages (ti vs no ti)\\n   - Get first reference of task_info in vm_init(), put last\\n     in vm_fini()\\n\\nV4: Fixed review comments from Felix\\n   - fix double reference increment in create_task_info\\n   - change amdgpu_vm_get_task_info_pasid\\n   - additional changes in amdgpu_gem.c while porting\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"4.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-09-16T08:02:39.206Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41008\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-09-16T08:02:39.206Z\", \"dateReserved\": \"2024-07-12T12:17:45.610Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-16T08:03:47.091Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

WID-SEC-W-2024-1613

Vulnerability from csaf_certbund - Published: 2024-07-15 22:00 - Updated: 2025-03-11 23:00

Summary

Linux Kernel: Schwachstelle ermöglicht nicht spezifizierten Angriff

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Der Kernel stellt den Kern des Linux Betriebssystems dar.

Angriff: Ein lokaler Angreifer kann eine Schwachstelle im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Betroffene Betriebssysteme: - Linux

CVE-2024-41008

Affected products

Known affected 6 products

Product	Identifier	Version
Dell PowerEdge Dell	`cpe:/h:dell:poweredge:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Open Source Linux Kernel <6.9 Open Source / Linux Kernel		<6.9

References

12 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
http://lore.kernel.org/linux-cve-announce/2024071…	external
https://access.redhat.com/errata/RHSA-2024:7001	external
https://access.redhat.com/errata/RHSA-2024:7000	external
https://linux.oracle.com/errata/ELSA-2024-7000.html	external
https://errata.build.resf.org/RLSA-2024:7001	external
https://access.redhat.com/errata/RHSA-2024:8318	external
https://access.redhat.com/errata/RHSA-2024:9315	external
https://access.redhat.com/errata/RHSA-2024:10771	external
https://www.dell.com/support/kbdoc/de-de/00028967…	external
https://support.lenovo.com/us/en/product_security…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Der Kernel stellt den Kern des Linux Betriebssystems dar.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann eine Schwachstelle im Linux Kernel ausnutzen, um einen nicht n\u00e4her spezifizierten Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1613 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1613.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1613 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1613"
      },
      {
        "category": "external",
        "summary": "Linux CVE Announce vom 2024-07-15",
        "url": "http://lore.kernel.org/linux-cve-announce/20240716080357.2696435-2-lee@kernel.org/"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:7001 vom 2024-09-24",
        "url": "https://access.redhat.com/errata/RHSA-2024:7001"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:7000 vom 2024-09-24",
        "url": "https://access.redhat.com/errata/RHSA-2024:7000"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-7000 vom 2024-09-26",
        "url": "https://linux.oracle.com/errata/ELSA-2024-7000.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2024:7001 vom 2024-09-30",
        "url": "https://errata.build.resf.org/RLSA-2024:7001"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:8318 vom 2024-10-23",
        "url": "https://access.redhat.com/errata/RHSA-2024:8318"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:9315 vom 2024-11-12",
        "url": "https://access.redhat.com/errata/RHSA-2024:9315"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10771 vom 2024-12-04",
        "url": "https://access.redhat.com/errata/RHSA-2024:10771"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2025-103 vom 2025-02-25",
        "url": "https://www.dell.com/support/kbdoc/de-de/000289674/dsa-2025-103-security-update-for-dell-amd-based-gpu-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "Lenovo Security Advisory LEN-191494 vom 2025-03-11",
        "url": "https://support.lenovo.com/us/en/product_security/LEN-191494"
      }
    ],
    "source_lang": "en-US",
    "title": "Linux Kernel: Schwachstelle erm\u00f6glicht nicht spezifizierten Angriff",
    "tracking": {
      "current_release_date": "2025-03-11T23:00:00.000+00:00",
      "generator": {
        "date": "2025-03-12T09:23:35.135+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.12"
        }
      },
      "id": "WID-SEC-W-2024-1613",
      "initial_release_date": "2024-07-15T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-07-15T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-09-23T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-09-25T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-09-30T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2024-10-23T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-11-12T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-12-03T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-02-25T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2025-03-11T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von LENOVO aufgenommen"
        }
      ],
      "status": "final",
      "version": "9"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Dell PowerEdge",
            "product": {
              "name": "Dell PowerEdge",
              "product_id": "T029908",
              "product_identification_helper": {
                "cpe": "cpe:/h:dell:poweredge:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Dell"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Lenovo Computer",
            "product": {
              "name": "Lenovo Computer",
              "product_id": "T026557",
              "product_identification_helper": {
                "cpe": "cpe:/h:lenovo:computer:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Lenovo"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.9",
                "product": {
                  "name": "Open Source Linux Kernel \u003c6.9",
                  "product_id": "T036154"
                }
              },
              {
                "category": "product_version",
                "name": "6.9",
                "product": {
                  "name": "Open Source Linux Kernel 6.9",
                  "product_id": "T036154-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:linux:linux_kernel:6.9"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Linux Kernel"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "RESF Rocky Linux",
            "product": {
              "name": "RESF Rocky Linux",
              "product_id": "T032255",
              "product_identification_helper": {
                "cpe": "cpe:/o:resf:rocky_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-41008",
      "product_status": {
        "known_affected": [
          "T029908",
          "67646",
          "T026557",
          "T004914",
          "T032255",
          "T036154"
        ]
      },
      "release_date": "2024-07-15T22:00:00.000+00:00",
      "title": "CVE-2024-41008"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-41008 (GCVE-0-2024-41008)

WID-SEC-W-2024-1613

Tags

Sightings

Nomenclature