Critical UAF Vulnerability in Linux Kernel: drm/xe Job Management Issue
Summary
DEBIAN-CVE-2024-50149: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't free job in TDR Freeing job in TDR is not safe as TDR can pass the run_job thread resulting in UAF. Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware resources and provides essential services for software applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting system integrity and user safety. This specific vulnerability affects the drm/xe subsystem, which is responsible for managing graphics rendering jobs, highlighting the importance of maintaining robust security practices in kernel development.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the drm/xe subsystem related to job management. The issue arises from the unsafe freeing of jobs in the TDR (Timeout Detection and Recovery) process, which can lead to a use-after-free (UAF) condition. This occurs when a job is freed while still being accessed by the run_job thread, potentially allowing an attacker to exploit this flaw to execute arbitrary code or crash the system. The vulnerability was introduced in earlier versions of the kernel and has been addressed in the patched version.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as possible to mitigate any risks associated with the UAF condition.
Conclusion
The identified vulnerability in the Linux kernel's drm/xe subsystem poses a significant risk due to the potential for use-after-free conditions. Users are strongly encouraged to update their systems to the patched version to ensure security and stability. Regular monitoring and prompt updates are essential practices for maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to arbitrary code execution or system crashes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
The vulnerability could allow an attacker to execute arbitrary code, crash the system, or compromise sensitive data, posing significant risks to system integrity and security.
Yes, the vulnerability affects versions prior to 6.11.6-1. It is crucial to update to this version or later to mitigate the risk.
While there are no specific workarounds, it is advisable to monitor your system closely for any unusual activity and plan to apply the update as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
