{"id":"CVE-2024-42123","state":"PUBLISHED","title":"drm/amdgpu: fix double free err_addr pointer warnings","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix double free err_addr pointer warnings\n\nIn amdgpu_umc_bad_page_polling_timeout, the amdgpu_umc_handle_bad_pages\nwill be run many times so that double free err_addr in some special case.\nSo set the err_addr to NULL to avoid the warnings.","publishedAt":"2024-07-30T07:46:15.130Z","updatedAt":"2026-10-30T12:18:51.727Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","status":"affected","lessThan":"e4233036eaa4c6a4087e42bb18bc853b4b5fab3b","versionType":"git"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","status":"affected","lessThan":"1eb6c4a0d83d1f348d718f813706105eff8cfc74","versionType":"git"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","status":"affected","lessThan":"8e24beb3c2b08a4763f920399a9cc577ed440a1a","versionType":"git"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","status":"affected","lessThan":"506c245f3f1cd989cb89811a7f06e04ff8813a0d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.2","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.9.9","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c"]}],"references":["https://git.kernel.org/stable/c/e4233036eaa4c6a4087e42bb18bc853b4b5fab3b","https://git.kernel.org/stable/c/1eb6c4a0d83d1f348d718f813706105eff8cfc74","https://git.kernel.org/stable/c/8e24beb3c2b08a4763f920399a9cc577ed440a1a","https://git.kernel.org/stable/c/506c245f3f1cd989cb89811a7f06e04ff8813a0d"],"weaknesses":[],"ingestedAt":"2026-10-30T12:36:04.432Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/42xxx/CVE-2024-42123.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-42123","state":"PUBLISHED","datePublished":"2024-07-30T07:46:15.130Z","dateUpdated":"2026-10-30T12:18:51.727Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-07-29T15:50:41.179Z"},"containers":{"cna":{"title":"drm/amdgpu: fix double free err_addr pointer warnings","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix double free err_addr pointer warnings\n\nIn amdgpu_umc_bad_page_polling_timeout, the amdgpu_umc_handle_bad_pages\nwill be run many times so that double free err_addr in some special case.\nSo set the err_addr to NULL to avoid the warnings."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","status":"affected","lessThan":"e4233036eaa4c6a4087e42bb18bc853b4b5fab3b","versionType":"git"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","status":"affected","lessThan":"1eb6c4a0d83d1f348d718f813706105eff8cfc74","versionType":"git"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","status":"affected","lessThan":"8e24beb3c2b08a4763f920399a9cc577ed440a1a","versionType":"git"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","status":"affected","lessThan":"506c245f3f1cd989cb89811a7f06e04ff8813a0d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.2","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.9.9","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/e4233036eaa4c6a4087e42bb18bc853b4b5fab3b"},{"url":"https://git.kernel.org/stable/c/1eb6c4a0d83d1f348d718f813706105eff8cfc74"},{"url":"https://git.kernel.org/stable/c/8e24beb3c2b08a4763f920399a9cc577ed440a1a"},{"url":"https://git.kernel.org/stable/c/506c245f3f1cd989cb89811a7f06e04ff8813a0d"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached only through local GPU access — a compute job on /dev/kfd + /dev/dri/renderD* raising a per-PASID poison-consumption interrupt, or the driver's own page-retirement kthread. No network or adjacent-network input reaches amdgpu_umc_handle_bad_pages().\nAC:H - Triggering requires a real uncorrectable ECC/poison event in GPU HBM and, on a later poll iteration, amdgpu_dpm_get_ecc_info() returning a value other than 0 or -EOPNOTSUPP so that neither allocation branch runs — both conditions are hardware/firmware state the attacker cannot manufacture. The ~100-iteration polling loop gives many attempts per event, but the initiating hardware fault remains outside attacker control.\nPR:L - The consumption side is driven by an unprivileged userspace compute process — event_interrupt_poison_consumption_v11() dispatches on the job's PASID, and /dev/kfd and /dev/dri/renderD* are routinely granted to the render group on ML/HPC and multi-tenant GPU nodes and inside GPU containers. Root is not required (the debugfs ras_ctrl injection interface is merely a more reliable alternate route, and is itself created with world-writable S_IWUGO mode bits).\nUI:N - The double free happens autonomously inside the RAS interrupt handler and the amdgpu_ras_page_retirement_thread kthread once the poison event occurs. No victim action of any kind is needed.\nS:U - The corruption is confined to the host kernel's slab allocator, within the same security authority. The SR-IOV VF branch of amdgpu_umc_poison_handler() bypasses this code entirely, so no guest-to-host or IOMMU boundary is crossed.\nC:H - Beyond the generic UAF read primitive from a double free, there is a concrete disclosure path: the stale err_addr is passed to amdgpu_ras_add_bad_pages() with a persisted err_addr_cnt, copying freed slab contents into con->eh_data->bps, which are then persisted to the RAS EEPROM and readable by any local user through the S_IRUGO gpu_vram_bad_pages sysfs binary attribute.\nI:H - Freeing the same kcalloc'd object twice corrupts the SLUB freelist and, if the object is reallocated between the two frees, releases a live in-use allocation — a standard route to a controlled arbitrary-write primitive. The stale-pointer data additionally drives amdgpu_vram_mgr_reserve_range() and permanent RAS EEPROM writes with garbage retired-page addresses.\nA:H - With CONFIG_SLAB_FREELIST_HARDENED or SLUB debug the double free is detected and panics/BUGs immediately; without it the resulting freelist corruption and use-after-free crash the kernel. Either way the outcome is a full denial of service, compounded by the mode-2 GPU reset already in flight on this path."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:18:51.727Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.9.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/8e24beb3c2b08a4763f920399a9cc577ed440a1a","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/506c245f3f1cd989cb89811a7f06e04ff8813a0d","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T04:54:32.545Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-42123","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T16:16:50.921873Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:33:04.953Z"}}]}}}