{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-35817","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-17T12:19:12.343Z","datePublished":"2024-05-17T13:23:21.720Z","dateUpdated":"2026-08-05T11:30:09.099Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:30:09.099Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag\n\nOtherwise after the GTT bo is released, the GTT and gart space is freed\nbut amdgpu_ttm_backend_unbind will not clear the gart page table entry\nand leave valid mapping entry pointing to the stale system page. Then\nif GPU access the gart address mistakely, it will read undefined value\ninstead page fault, harder to debug and reproduce the real issue."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through `DRM_IOCTL_AMDGPU_CS`/`AMDGPU_GEM_CREATE` on the local `/dev/dri/renderD*` device node, requiring local system access. No network or adjacent-network reachability exists.\nAC:L - Triggering is a deterministic, race-free ioctl sequence — create a GTT BO, submit it as the CS user-fence BO, then release it — repeatable in a loop on any default amdgpu configuration. No conditions outside the attacker's control are involved.\nPR:L - Both required ioctls are `DRM_RENDER_ALLOW`, so any unprivileged user able to open the render node (standard for desktop sessions, `render`-group members, and GPU-enabled containers) can reach the code with no capabilities and without DRM master.\nUI:N - The attacking process performs the entire allocate/submit/free sequence itself; no victim action or interaction is needed.\nS:U - The stale mappings live in the GPU's own GART remap table and the affected resource is host kernel memory managed by the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The GART retains valid entries to system pages that have been freed and recycled for arbitrary kernel and user data, so GPU reads of that aperture return reclaimed memory contents instead of faulting — a use-after-free class disclosure primitive into attacker-visible GPU buffers.\nI:H - The same stale entries are writable by the GPU, giving DMA writes into pages the kernel has reallocated for other purposes (kernel objects, page tables, other processes' data), which is arbitrary memory corruption bypassing CPU MMU protection.\nA:H - GPU DMA into reclaimed kernel pages corrupts live kernel structures leading to oops/panic, and on IOMMU-enabled systems the torn-down DMA mappings produce IO_PAGE_FAULT storms, GPU hangs, and device resets."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"],"versions":[{"version":"0b988ca1c7c4c73983b4ea96ef7c2af2263c87eb","lessThan":"5d5f1a7f3b1039925f79c7894f153c2a905201fb","status":"affected","versionType":"git"},{"version":"0b988ca1c7c4c73983b4ea96ef7c2af2263c87eb","lessThan":"589c414138a1bed98e652c905937d8f790804efe","status":"affected","versionType":"git"},{"version":"0b988ca1c7c4c73983b4ea96ef7c2af2263c87eb","lessThan":"6fcd12cb90888ef2d8af8d4c04e913252eee4ef3","status":"affected","versionType":"git"},{"version":"0b988ca1c7c4c73983b4ea96ef7c2af2263c87eb","lessThan":"e8d27caef2c829a306e1f762fb95f06e8ec676f6","status":"affected","versionType":"git"},{"version":"0b988ca1c7c4c73983b4ea96ef7c2af2263c87eb","lessThan":"5cdce3dda3b3dacde902f63a8ee72c2b7f91912d","status":"affected","versionType":"git"},{"version":"0b988ca1c7c4c73983b4ea96ef7c2af2263c87eb","lessThan":"6c6064cbe58b43533e3451ad6a8ba9736c109ac3","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"],"versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","status":"unaffected","versionType":"semver"},{"version":"5.15.154","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.84","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.24","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.12","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8.3","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.15.154"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.1.84"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.6.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.7.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.8.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/5d5f1a7f3b1039925f79c7894f153c2a905201fb"},{"url":"https://git.kernel.org/stable/c/589c414138a1bed98e652c905937d8f790804efe"},{"url":"https://git.kernel.org/stable/c/6fcd12cb90888ef2d8af8d4c04e913252eee4ef3"},{"url":"https://git.kernel.org/stable/c/e8d27caef2c829a306e1f762fb95f06e8ec676f6"},{"url":"https://git.kernel.org/stable/c/5cdce3dda3b3dacde902f63a8ee72c2b7f91912d"},{"url":"https://git.kernel.org/stable/c/6c6064cbe58b43533e3451ad6a8ba9736c109ac3"}],"title":"drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-17T17:39:20.658844Z","id":"CVE-2024-35817","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-17T17:43:20.646Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:21:48.065Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/5d5f1a7f3b1039925f79c7894f153c2a905201fb","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/589c414138a1bed98e652c905937d8f790804efe","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/6fcd12cb90888ef2d8af8d4c04e913252eee4ef3","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e8d27caef2c829a306e1f762fb95f06e8ec676f6","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/5cdce3dda3b3dacde902f63a8ee72c2b7f91912d","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/6c6064cbe58b43533e3451ad6a8ba9736c109ac3","tags":["x_transferred"]}]}]}}