In the Linux kernel, the following vulnerability has been resolved:
nouveau/dmem: Fix vulnerability in migratetoram upon copy error
The nouveau_dmem_copy_one function ensures that the copy push command is
sent to the device firmware but does not track whether it was executed
successfully.
In the case of a copy error (e.g., firmware or hardware failure), the
copy push command will be sent via the firmware channel, and
nouveau_dmem_copy_one will likely report success, leading to the
migrate_to_ram function returning a dirty HIGH_USER page to the user.
This can result in a security vulnerability, as a HIGH_USER page that may contain sensitive or corrupted data could be returned to the user.
To prevent this vulnerability, we allocate a zero page. Thus, in case of an error, a non-dirty (zero) page will be returned to the user.
[
{
"id": "CVE-2024-50096-0305655b",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c",
"function": "nouveau_dmem_migrate_to_ram"
},
"digest": {
"function_hash": "299659619481439235522195179282586042286",
"length": 1213.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab4d113b6718b076046018292f821d5aa4b844f8",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-113b74e3",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"110170463281909413993217778593010018778",
"321635065444547722879967098232122338831",
"133273685241999026332127409775398621737",
"181585391080300004247142464909039498313"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c3de9282dde21ce3c1bf1bde3166a4510547aa9",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-2f0025b9",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c",
"function": "nouveau_dmem_migrate_to_ram"
},
"digest": {
"function_hash": "299659619481439235522195179282586042286",
"length": 1213.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@697e3ddcf1f8b68bd531fc34eead27c000bdf3e1",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-4ebb28ed",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"110170463281909413993217778593010018778",
"321635065444547722879967098232122338831",
"133273685241999026332127409775398621737",
"181585391080300004247142464909039498313"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd9bb7e996bab9b9049fffe3f3d3b50dee191d27",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-6bca7c6c",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c",
"function": "nouveau_dmem_migrate_to_ram"
},
"digest": {
"function_hash": "20489877474052742239598345076666721181",
"length": 1221.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@614bfb2050982d23d53d0d51c4079dba0437c883",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-718a594c",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"95380918919190197450043892956675079081",
"25299617969221157865715289238688479734",
"278746897849494830305366028263694417284",
"111214403340398121170800883851586320791"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab4d113b6718b076046018292f821d5aa4b844f8",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-76aad47f",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"95380918919190197450043892956675079081",
"25299617969221157865715289238688479734",
"278746897849494830305366028263694417284",
"111214403340398121170800883851586320791"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@697e3ddcf1f8b68bd531fc34eead27c000bdf3e1",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-96d42c2a",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c",
"function": "nouveau_dmem_fault_copy_one"
},
"digest": {
"function_hash": "248740970941441459911314789014394864704",
"length": 1079.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73f75d2b5aee5a735cf64b8ab4543d5c20dbbdd9",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-a3342a47",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"95380918919190197450043892956675079081",
"25299617969221157865715289238688479734",
"278746897849494830305366028263694417284",
"111214403340398121170800883851586320791"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@835745a377a4519decd1a36d6b926e369b3033e2",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-a7060575",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"95380918919190197450043892956675079081",
"25299617969221157865715289238688479734",
"278746897849494830305366028263694417284",
"111214403340398121170800883851586320791"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@614bfb2050982d23d53d0d51c4079dba0437c883",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-c9c68593",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c",
"function": "nouveau_dmem_fault_copy_one"
},
"digest": {
"function_hash": "248740970941441459911314789014394864704",
"length": 1079.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c3de9282dde21ce3c1bf1bde3166a4510547aa9",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-d5213dbb",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c",
"function": "nouveau_dmem_migrate_to_ram"
},
"digest": {
"function_hash": "299659619481439235522195179282586042286",
"length": 1213.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@835745a377a4519decd1a36d6b926e369b3033e2",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-e202f910",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"110170463281909413993217778593010018778",
"321635065444547722879967098232122338831",
"133273685241999026332127409775398621737",
"181585391080300004247142464909039498313"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73f75d2b5aee5a735cf64b8ab4543d5c20dbbdd9",
"signature_version": "v1"
},
{
"id": "CVE-2024-50096-e210add2",
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_dmem.c",
"function": "nouveau_dmem_fault_copy_one"
},
"digest": {
"function_hash": "105292816762212214411031417560695013625",
"length": 892.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd9bb7e996bab9b9049fffe3f3d3b50dee191d27",
"signature_version": "v1"
}
]