{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-35951","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-17T13:50:33.135Z","datePublished":"2024-05-20T09:41:45.999Z","dateUpdated":"2026-08-05T11:31:10.737Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:31:10.737Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()\n\nSubject: [PATCH] drm/panfrost: Fix the error path in\n panfrost_mmu_map_fault_addr()\n\nIf some the pages or sgt allocation failed, we shouldn't release the\npages ref we got earlier, otherwise we will end up with unbalanced\nget/put_pages() calls. We should instead leave everything in place\nand let the BO release function deal with extra cleanup when the object\nis destroyed, or let the fault handler try again next time it's called."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached only through local ioctls (PANFROST_IOCTL_CREATE_BO with PANFROST_BO_HEAP, then PANFROST_IOCTL_SUBMIT) on the DRM render node /dev/dri/renderD128. No network or adjacent-network exposure exists.\nAC:L - The error path requires an allocation failure, and the BO's shmem mapping is deliberately created with __GFP_RETRY_MAYFAIL|GFP_HIGHUSER so it returns -ENOMEM instead of OOM-killing; the attacker fully controls memory pressure and GPU IOVA exhaustion (failing dma_map_sgtable) and can re-trigger the fault in a loop with no race to win.\nPR:L - Both required ioctls are DRM_RENDER_ALLOW, so any local unprivileged user with render-node access — the default for logged-in desktop users, and for every application on Android/ChromeOS devices using Mali GPUs — can reach the code with no capabilities.\nUI:N - The attacker performs every step itself: creating the heap BO, submitting the job that faults, and generating the memory pressure. No victim action is involved.\nS:U - The buggy driver and the corrupted memory both reside within the kernel's security authority; this is standard kernel memory corruption rather than a VM or hypervisor boundary escape.\nC:H - Pages that remain mapped read/write in the GPU address space lose their driver reference and are made evictable, so once reclaimed and reused the attacker's GPU shaders can read arbitrary recycled kernel and userspace memory through the stale mapping.\nI:H - The stale GPU mappings carry IOMMU_WRITE, giving the attacker an arbitrary write primitive into reclaimed memory, and the leaked/overwritten sg tables plus re-mapping over live PTEs further corrupt the GPU page tables and page refcounts.\nA:H - The unbalanced put_pages corrupts page reference counts and permanently leaks sg tables and DMA/IOVA mappings, while the failed fault disables the GPU address space and kills all jobs on it; repeated triggering yields memory exhaustion and kernel oopses/panics."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/panfrost/panfrost_mmu.c"],"versions":[{"version":"187d2929206e6b098312c174ea873e4cedf5420d","lessThan":"31806711e8a4b75e09b1c43652f2a6420e6e1002","status":"affected","versionType":"git"},{"version":"187d2929206e6b098312c174ea873e4cedf5420d","lessThan":"e18070c622c63f0cab170348e320454728c277aa","status":"affected","versionType":"git"},{"version":"187d2929206e6b098312c174ea873e4cedf5420d","lessThan":"1fc9af813b25e146d3607669247d0f970f5a87c3","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/panfrost/panfrost_mmu.c"],"versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","status":"unaffected","versionType":"semver"},{"version":"6.6.28","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.8.7","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.6.28"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.8.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/31806711e8a4b75e09b1c43652f2a6420e6e1002"},{"url":"https://git.kernel.org/stable/c/e18070c622c63f0cab170348e320454728c277aa"},{"url":"https://git.kernel.org/stable/c/1fc9af813b25e146d3607669247d0f970f5a87c3"}],"title":"drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-35951","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-23T19:20:08.650498Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-04T17:33:35.617Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:21:48.983Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/31806711e8a4b75e09b1c43652f2a6420e6e1002","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e18070c622c63f0cab170348e320454728c277aa","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1fc9af813b25e146d3607669247d0f970f5a87c3","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/30/2","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/30/1","tags":["x_transferred"]}]}]},"dataVersion":"5.2"}