{"id":"CVE-2024-46803","state":"PUBLISHED","title":"drm/amdkfd: Check debug trap enable before write dbg_ev_file","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check debug trap enable before write dbg_ev_file\n\nIn interrupt context, write dbg_ev_file will be run by work queue. It\nwill cause write dbg_ev_file execution after debug_trap_disable, which\nwill cause NULL pointer access.\nv2: cancel work \"debug_event_workarea\" before set dbg_ev_file as NULL.","publishedAt":"2024-09-27T12:35:49.185Z","updatedAt":"2026-08-05T11:38:41.734Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0ab2d7532b05a3e7c06fd3b0c8bd6b46c1dfb508","status":"affected","lessThan":"e6ea3b8fe398915338147fe54dd2db8155fdafd8","versionType":"git"},{"version":"0ab2d7532b05a3e7c06fd3b0c8bd6b46c1dfb508","status":"affected","lessThan":"820dcbd38a77bd5fdc4236d521c1c122841227d0","versionType":"git"},{"version":"0ab2d7532b05a3e7c06fd3b0c8bd6b46c1dfb508","status":"affected","lessThan":"547033b593063eb85bfdf9b25a5f1b8fd1911be2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_debug.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.5","versionType":"semver"},{"version":"6.6.50","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.9","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_debug.c"]}],"references":["https://git.kernel.org/stable/c/e6ea3b8fe398915338147fe54dd2db8155fdafd8","https://git.kernel.org/stable/c/820dcbd38a77bd5fdc4236d521c1c122841227d0","https://git.kernel.org/stable/c/547033b593063eb85bfdf9b25a5f1b8fd1911be2"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/46xxx/CVE-2024-46803.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-46803","state":"PUBLISHED","datePublished":"2024-09-27T12:35:49.185Z","dateUpdated":"2026-08-05T11:38:41.734Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-09-11T15:12:18.281Z"},"containers":{"cna":{"title":"drm/amdkfd: Check debug trap enable before write dbg_ev_file","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check debug trap enable before write dbg_ev_file\n\nIn interrupt context, write dbg_ev_file will be run by work queue. It\nwill cause write dbg_ev_file execution after debug_trap_disable, which\nwill cause NULL pointer access.\nv2: cancel work \"debug_event_workarea\" before set dbg_ev_file as NULL."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0ab2d7532b05a3e7c06fd3b0c8bd6b46c1dfb508","status":"affected","lessThan":"e6ea3b8fe398915338147fe54dd2db8155fdafd8","versionType":"git"},{"version":"0ab2d7532b05a3e7c06fd3b0c8bd6b46c1dfb508","status":"affected","lessThan":"820dcbd38a77bd5fdc4236d521c1c122841227d0","versionType":"git"},{"version":"0ab2d7532b05a3e7c06fd3b0c8bd6b46c1dfb508","status":"affected","lessThan":"547033b593063eb85bfdf9b25a5f1b8fd1911be2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_debug.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.5","versionType":"semver"},{"version":"6.6.50","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.9","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_debug.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/e6ea3b8fe398915338147fe54dd2db8155fdafd8"},{"url":"https://git.kernel.org/stable/c/820dcbd38a77bd5fdc4236d521c1c122841227d0"},{"url":"https://git.kernel.org/stable/c/547033b593063eb85bfdf9b25a5f1b8fd1911be2"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached through the AMDKFD_IOC_DBG_TRAP ioctl on the /dev/kfd character device (and the process-teardown path), requiring local access to the machine. No network or remote protocol handling is involved.\nAC:L - The attacker controls both sides of the race: they flood debug exceptions by submitting shaders that raise SQ traps/bad opcodes/memory violations (queuing the work item from GPU IRQ) while concurrently issuing KFD_IOC_DBG_TRAP_DISABLE in a loop, and can retry indefinitely until the window is hit.\nPR:L - Only an unprivileged local account with access to /dev/kfd is needed — kfd_open() performs no capability check and the ptrace_parent() gate in kfd_ioctl_set_debug_trap() is bypassed entirely when a process debugs itself (target == p). ROCm systems ship /dev/kfd world- or render-group-accessible, so any local user on an AMD GPU compute node qualifies.\nUI:N - The attacking process performs every step itself — enabling debug trap, submitting the faulting GPU work, and disabling the trap. No victim action or interaction is required.\nS:U - The corruption and its consequences are confined to the kernel of the same host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - After fput() drops the last reference, the worker uses a dangling struct file from the filp slab cache, and an attacker who reclaims that object controls the f_op table used by kernel_write — a use-after-free that can be leveraged into arbitrary kernel memory disclosure.\nI:H - __kernel_write_iter() indirectly calls file->f_op->write_iter() on the freed struct file, giving a direct control-flow-hijack primitive once the attacker sprays the reclaimed filp object, which translates into arbitrary kernel write and privilege escalation.\nA:H - The commonly observed outcome is a NULL pointer dereference in kernel_write() from a kworker context, oopsing the kernel; the use-after-free variant likewise crashes the machine, and the attacker can trigger it repeatedly."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:38:41.734Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.6.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.10.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.11"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-29T14:20:52.974033Z","id":"CVE-2024-46803","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-29T14:21:05.556Z"}}]}}}