CVE-2024-35931 (GCVE-0-2024-35931)

Vulnerability from cvelistv5 – Published: 2024-05-19 10:10 – Updated: 2026-08-05 11:31
VLAI
Title
drm/amdgpu: Skip do PCI error slot reset during RAS recovery
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Skip do PCI error slot reset during RAS recovery Why: The PCI error slot reset maybe triggered after inject ue to UMC multi times, this caused system hang. [ 557.371857] amdgpu 0000:af:00.0: amdgpu: GPU reset succeeded, trying to resume [ 557.373718] [drm] PCIE GART of 512M enabled. [ 557.373722] [drm] PTB located at 0x0000031FED700000 [ 557.373788] [drm] VRAM is lost due to GPU reset! [ 557.373789] [drm] PSP is resuming... [ 557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Device state = 1 pci_status: 0. Exit, result = 3, need reset [ 557.547067] [drm] PCI error: detected callback, state(1)!! [ 557.547069] [drm] No support for XGMI hive yet... [ 557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 0. Enter [ 557.607763] mlx5_core 0000:55:00.0: wait vital counter value 0x16b5b after 1 iterations [ 557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 1. Exit, err = 0, result = 5, recovered [ 557.610492] [drm] PCI error: slot reset callback!! ... [ 560.689382] amdgpu 0000:3f:00.0: amdgpu: GPU reset(2) succeeded! [ 560.689546] amdgpu 0000:5a:00.0: amdgpu: GPU reset(2) succeeded! [ 560.689562] general protection fault, probably for non-canonical address 0x5f080b54534f611f: 0000 [#1] SMP NOPTI [ 560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G OE 5.15.0-91-generic #101-Ubuntu [ 560.712057] Hardware name: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 11/08/2023 [ 560.720959] Workqueue: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu] [ 560.728887] RIP: 0010:amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] [ 560.736891] Code: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff <48> 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00 [ 560.757967] RSP: 0018:ffa0000032e53d80 EFLAGS: 00010202 [ 560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0 [ 560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010 [ 560.779867] RBP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08 [ 560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 0000000000000000 [ 560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000 [ 560.803889] FS: 0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000 [ 560.812973] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0 [ 560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 560.835433] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 560.843444] PKRU: 55555554 [ 560.846480] Call Trace: [ 560.849225] <TASK> [ 560.851580] ? show_trace_log_lvl+0x1d6/0x2ea [ 560.856488] ? show_trace_log_lvl+0x1d6/0x2ea [ 560.861379] ? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] [ 560.867778] ? show_regs.part.0+0x23/0x29 [ 560.872293] ? __die_body.cold+0x8/0xd [ 560.876502] ? die_addr+0x3e/0x60 [ 560.880238] ? exc_general_protection+0x1c5/0x410 [ 560.885532] ? asm_exc_general_protection+0x27/0x30 [ 560.891025] ? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] [ 560.898323] amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] [ 560.904520] process_one_work+0x228/0x3d0 How: In RAS recovery, mode-1 reset is issued from RAS fatal error handling and expected all the nodes in a hive to be reset. no need to issue another mode-1 during this procedure.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 395ca1031acf89d8ecb26127c544a71688d96f35 (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 601429cca96b4af3be44172c3b64e4228515dbe1 (git)
Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 6.8.6 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.006Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/395ca1031acf89d8ecb26127c544a71688d96f35"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35931",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:41:01.828598Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:15.513Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "395ca1031acf89d8ecb26127c544a71688d96f35",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "601429cca96b4af3be44172c3b64e4228515dbe1",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.6",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Skip do PCI error slot reset during RAS recovery\n\nWhy:\n    The PCI error slot reset maybe triggered after inject ue to UMC multi times, this\n    caused system hang.\n    [  557.371857] amdgpu 0000:af:00.0: amdgpu: GPU reset succeeded, trying to resume\n    [  557.373718] [drm] PCIE GART of 512M enabled.\n    [  557.373722] [drm] PTB located at 0x0000031FED700000\n    [  557.373788] [drm] VRAM is lost due to GPU reset!\n    [  557.373789] [drm] PSP is resuming...\n    [  557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Device state = 1 pci_status: 0. Exit, result = 3, need reset\n    [  557.547067] [drm] PCI error: detected callback, state(1)!!\n    [  557.547069] [drm] No support for XGMI hive yet...\n    [  557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 0. Enter\n    [  557.607763] mlx5_core 0000:55:00.0: wait vital counter value 0x16b5b after 1 iterations\n    [  557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 1. Exit, err = 0, result = 5, recovered\n    [  557.610492] [drm] PCI error: slot reset callback!!\n    ...\n    [  560.689382] amdgpu 0000:3f:00.0: amdgpu: GPU reset(2) succeeded!\n    [  560.689546] amdgpu 0000:5a:00.0: amdgpu: GPU reset(2) succeeded!\n    [  560.689562] general protection fault, probably for non-canonical address 0x5f080b54534f611f: 0000 [#1] SMP NOPTI\n    [  560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G           OE     5.15.0-91-generic #101-Ubuntu\n    [  560.712057] Hardware name: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 11/08/2023\n    [  560.720959] Workqueue: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu]\n    [  560.728887] RIP: 0010:amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu]\n    [  560.736891] Code: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff \u003c48\u003e 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00\n    [  560.757967] RSP: 0018:ffa0000032e53d80 EFLAGS: 00010202\n    [  560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0\n    [  560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010\n    [  560.779867] RBP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08\n    [  560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 0000000000000000\n    [  560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000\n    [  560.803889] FS:  0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000\n    [  560.812973] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    [  560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0\n    [  560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n    [  560.835433] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n    [  560.843444] PKRU: 55555554\n    [  560.846480] Call Trace:\n    [  560.849225]  \u003cTASK\u003e\n    [  560.851580]  ? show_trace_log_lvl+0x1d6/0x2ea\n    [  560.856488]  ? show_trace_log_lvl+0x1d6/0x2ea\n    [  560.861379]  ? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu]\n    [  560.867778]  ? show_regs.part.0+0x23/0x29\n    [  560.872293]  ? __die_body.cold+0x8/0xd\n    [  560.876502]  ? die_addr+0x3e/0x60\n    [  560.880238]  ? exc_general_protection+0x1c5/0x410\n    [  560.885532]  ? asm_exc_general_protection+0x27/0x30\n    [  560.891025]  ? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu]\n    [  560.898323]  amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu]\n    [  560.904520]  process_one_work+0x228/0x3d0\nHow:\n    In RAS recovery, mode-1 reset is issued from RAS fatal error handling and expected\n    all the nodes in a hive to be reset. no need to issue another mode-1 during this procedure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the amdgpu PCI AER slot-reset callback racing the RAS recovery worker, reachable only from the local machine via GPU device access (`/dev/dri/renderD*` job submission causing poison consumption) or local debugfs RAS error injection. There is no remote or adjacent-network path to this driver code.\nAC:L - The concurrency is not a narrow race the attacker must win by luck \u2014 the RAS mode-1 reset itself generates the PCIe error that dispatches `amdgpu_pci_slot_reset()`, so one triggering event deterministically produces both overlapping reset paths, and the reporter reproduced it simply by repeating the trigger (\"inject ue to UMC multi times\"). An attacker who can reach the path can retry it indefinitely until the collision occurs.\nPR:L - An unprivileged local user with GPU render-node access (standard for any user running compute workloads on an MI300 node) can drive the GPU into RAS recovery via poison-consumption interrupts from submitted work, and `amdgpu_ras_debugfs_ctrl_write()` contains no capability check of its own. No root or CAP_SYS_ADMIN check exists on the code path itself.\nUI:N - No victim action is required; the corruption occurs entirely within kernel worker threads (`amdgpu-reset-hive` and the AER recovery thread) once the reset paths overlap.\nS:U - The list corruption and the resulting memory access all occur within the host kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale list pointer causes `container_of()` to produce an attacker-influenceable `struct amdgpu_device *` derived from reused kernel stack memory, and the loop body then dereferences many fields through it \u2014 an unbounded kernel-memory read primitive of the use-after-free class.\nI:H - This is list corruption plus a dangling stack list head: `__list_add()` writes through the corrupted `prev`/`next` pointers, and the recovery loop writes through the bogus `tmp_adev` (`shutdown = true`, `atomic_inc(\u0026gpu_reset_counter)`, mp1-state and reset-domain updates), giving a write primitive at controllable offsets that is exploitable for control-flow hijacking.\nA:H - The reported and reproducible outcome is a general protection fault on a non-canonical address inside a kernel workqueue during GPU reset, described by the reporter as hanging the system \u2014 a full kernel crash/hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:02.773Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/395ca1031acf89d8ecb26127c544a71688d96f35"
        },
        {
          "url": "https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1"
        }
      ],
      "title": "drm/amdgpu: Skip do PCI error slot reset during RAS recovery",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35931",
    "datePublished": "2024-05-19T10:10:39.706Z",
    "dateReserved": "2024-05-17T13:50:33.129Z",
    "dateUpdated": "2026-08-05T11:31:02.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35931",
      "date": "2026-08-05",
      "epss": "0.00195",
      "percentile": "0.09456"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: Skip do PCI error slot reset during RAS recovery\\n\\nWhy:\\n    The PCI error slot reset maybe triggered after inject ue to UMC multi times, this\\n    caused system hang.\\n    [  557.371857] amdgpu 0000:af:00.0: amdgpu: GPU reset succeeded, trying to resume\\n    [  557.373718] [drm] PCIE GART of 512M enabled.\\n    [  557.373722] [drm] PTB located at 0x0000031FED700000\\n    [  557.373788] [drm] VRAM is lost due to GPU reset!\\n    [  557.373789] [drm] PSP is resuming...\\n    [  557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Device state = 1 pci_status: 0. Exit, result = 3, need reset\\n    [  557.547067] [drm] PCI error: detected callback, state(1)!!\\n    [  557.547069] [drm] No support for XGMI hive yet...\\n    [  557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 0. Enter\\n    [  557.607763] mlx5_core 0000:55:00.0: wait vital counter value 0x16b5b after 1 iterations\\n    [  557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 1. Exit, err = 0, result = 5, recovered\\n    [  557.610492] [drm] PCI error: slot reset callback!!\\n    ...\\n    [  560.689382] amdgpu 0000:3f:00.0: amdgpu: GPU reset(2) succeeded!\\n    [  560.689546] amdgpu 0000:5a:00.0: amdgpu: GPU reset(2) succeeded!\\n    [  560.689562] general protection fault, probably for non-canonical address 0x5f080b54534f611f: 0000 [#1] SMP NOPTI\\n    [  560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G           OE     5.15.0-91-generic #101-Ubuntu\\n    [  560.712057] Hardware name: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 11/08/2023\\n    [  560.720959] Workqueue: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu]\\n    [  560.728887] RIP: 0010:amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu]\\n    [  560.736891] Code: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff \u003c48\u003e 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00\\n    [  560.757967] RSP: 0018:ffa0000032e53d80 EFLAGS: 00010202\\n    [  560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0\\n    [  560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010\\n    [  560.779867] RBP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08\\n    [  560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 0000000000000000\\n    [  560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000\\n    [  560.803889] FS:  0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000\\n    [  560.812973] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n    [  560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0\\n    [  560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n    [  560.835433] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\\n    [  560.843444] PKRU: 55555554\\n    [  560.846480] Call Trace:\\n    [  560.849225]  \u003cTASK\u003e\\n    [  560.851580]  ? show_trace_log_lvl+0x1d6/0x2ea\\n    [  560.856488]  ? show_trace_log_lvl+0x1d6/0x2ea\\n    [  560.861379]  ? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu]\\n    [  560.867778]  ? show_regs.part.0+0x23/0x29\\n    [  560.872293]  ? __die_body.cold+0x8/0xd\\n    [  560.876502]  ? die_addr+0x3e/0x60\\n    [  560.880238]  ? exc_general_protection+0x1c5/0x410\\n    [  560.885532]  ? asm_exc_general_protection+0x27/0x30\\n    [  560.891025]  ? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu]\\n    [  560.898323]  amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu]\\n    [  560.904520]  process_one_work+0x228/0x3d0\\nHow:\\n    In RAS recovery, mode-1 reset is issued from RAS fatal error handling and expected\\n    all the nodes in a hive to be reset. no need to issue another mode-1 during this procedure.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: drm/amdgpu: Omitir el restablecimiento de la ranura de error PCI durante la recuperaci\\u00f3n de RAS Por qu\\u00e9: El restablecimiento de la ranura de error PCI puede activarse despu\\u00e9s de inyectar ue en UMC varias veces, lo que provoc\\u00f3 que el sistema se bloqueara. [ 557.371857] amdgpu 0000:af:00.0: amdgpu: el reinicio de la GPU se realiz\\u00f3 correctamente, intentando reanudar [ 557.373718] [drm] PCIE GART de 512M habilitado. [ 557.373722] [drm] PTB ubicado en 0x0000031FED700000 [ 557.373788] [drm] \\u00a1La VRAM se pierde debido al reinicio de la GPU! [ 557.373789] [drm] PSP se est\\u00e1 reanudando... [ 557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Estado del dispositivo = 1 pci_status: 0. Salir, resultado = 3, es necesario restablecer [ 557.547067] [drm] Error de PCI: devoluci\\u00f3n de llamada detectada , estado(1)!! [ 557.547069] [drm] A\\u00fan no hay soporte para XGMI hive... [ 557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Estado del dispositivo = 1 pci_status: 0. Ingrese [ 557.607763] mlx5_core 0000:55:00.0: espere el valor del contador vital 0x16b5b despu\\u00e9s de 1 iteraci\\u00f3n [557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Estado del dispositivo = 1 pci_status: 1. Salir, err = 0, resultado = 5, recuperado [557.610492] [drm] Error de PCI: \\u00a1devoluci\\u00f3n de llamada de restablecimiento de ranura! ... [ 560.689382] amdgpu 0000:3f:00.0: amdgpu: \\u00a1El reinicio de GPU (2) se realiz\\u00f3 correctamente! [ 560.689546] amdgpu 0000:5a:00.0: amdgpu: \\u00a1El reinicio de GPU (2) se realiz\\u00f3 correctamente! [ 560.689562] falla de protecci\\u00f3n general, probablemente para direcci\\u00f3n no can\\u00f3nica 0x5f080b54534f611f: 0000 [#1] SMP NOPTI [ 560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G OE 5.15.0-91-generic # 101-Ubuntu [ 560.712057] Nombre de hardware: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 08/11/2023 [ 560.720959] Cola de trabajo: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu] [ 87] QEPD: 0010: amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] [ 560.736891] C\\u00f3digo: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff \u0026lt;48\u0026gt; 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00 [ 560.757967] RSP: 0018:ffa0000032e53d80 00010202 [560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0 [ 560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010 [ 560.779867] BP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08 [ 560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 000 [560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000 [ 560.803889] FS: 0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000 [ 560.812973] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0 [ 560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 560.835433] DR3: 0000000000000000 DR6: 00000000ffe07f0 DR7: 0000000000000400 [ 560.843444] PKRU: 55555554 [ 560.846480] Seguimiento de llamadas: [ 560.849225]  [ 560.851580] ? show_trace_log_lvl+0x1d6/0x2ea [560.856488]? show_trace_log_lvl+0x1d6/0x2ea [560.861379]? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] [ 560.867778] ? show_regs.part.0+0x23/0x29 [560.872293]? __die_body.cold+0x8/0xd [ 560.876502] ? die_addr+0x3e/0x60 [ 560.880238] ? exc_general_protection+0x1c5/0x410 [560.885532]? asm_exc_general_protection+0x27/0x30 [560.891025]? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] [ 560.898323] amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] [ 560.904520] Process_one_work+0x228/0x3d0 C\\u00f3mo: En la recuperaci\\u00f3n de RAS, el restablecimiento del modo 1 se emite desde RAS fatal manejo de errores y esperaba todos los nodos en una colmena que se van a restablecer. no es necesario emitir otro modo-1 durante este procedimiento.\"}]",
      "id": "CVE-2024-35931",
      "lastModified": "2024-11-21T09:21:13.837",
      "published": "2024-05-19T11:15:49.133",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/395ca1031acf89d8ecb26127c544a71688d96f35\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/395ca1031acf89d8ecb26127c544a71688d96f35\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:50:27.000Z",
      "cve": "CVE-2024-35931",
      "id": "msrc_CVE-2024-35931",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_affected": "18",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amdgpu: Skip do PCI error slot reset during RAS recovery",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-35931.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35931\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T11:15:49.133\",\"lastModified\":\"2026-08-04T11:18:12.580\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: Skip do PCI error slot reset during RAS recovery\\n\\nWhy:\\n    The PCI error slot reset maybe triggered after inject ue to UMC multi times, this\\n    caused system hang.\\n    [  557.371857] amdgpu 0000:af:00.0: amdgpu: GPU reset succeeded, trying to resume\\n    [  557.373718] [drm] PCIE GART of 512M enabled.\\n    [  557.373722] [drm] PTB located at 0x0000031FED700000\\n    [  557.373788] [drm] VRAM is lost due to GPU reset!\\n    [  557.373789] [drm] PSP is resuming...\\n    [  557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Device state = 1 pci_status: 0. Exit, result = 3, need reset\\n    [  557.547067] [drm] PCI error: detected callback, state(1)!!\\n    [  557.547069] [drm] No support for XGMI hive yet...\\n    [  557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 0. Enter\\n    [  557.607763] mlx5_core 0000:55:00.0: wait vital counter value 0x16b5b after 1 iterations\\n    [  557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 1. Exit, err = 0, result = 5, recovered\\n    [  557.610492] [drm] PCI error: slot reset callback!!\\n    ...\\n    [  560.689382] amdgpu 0000:3f:00.0: amdgpu: GPU reset(2) succeeded!\\n    [  560.689546] amdgpu 0000:5a:00.0: amdgpu: GPU reset(2) succeeded!\\n    [  560.689562] general protection fault, probably for non-canonical address 0x5f080b54534f611f: 0000 [#1] SMP NOPTI\\n    [  560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G           OE     5.15.0-91-generic #101-Ubuntu\\n    [  560.712057] Hardware name: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 11/08/2023\\n    [  560.720959] Workqueue: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu]\\n    [  560.728887] RIP: 0010:amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu]\\n    [  560.736891] Code: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff \u003c48\u003e 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00\\n    [  560.757967] RSP: 0018:ffa0000032e53d80 EFLAGS: 00010202\\n    [  560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0\\n    [  560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010\\n    [  560.779867] RBP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08\\n    [  560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 0000000000000000\\n    [  560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000\\n    [  560.803889] FS:  0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000\\n    [  560.812973] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n    [  560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0\\n    [  560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n    [  560.835433] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\\n    [  560.843444] PKRU: 55555554\\n    [  560.846480] Call Trace:\\n    [  560.849225]  \u003cTASK\u003e\\n    [  560.851580]  ? show_trace_log_lvl+0x1d6/0x2ea\\n    [  560.856488]  ? show_trace_log_lvl+0x1d6/0x2ea\\n    [  560.861379]  ? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu]\\n    [  560.867778]  ? show_regs.part.0+0x23/0x29\\n    [  560.872293]  ? __die_body.cold+0x8/0xd\\n    [  560.876502]  ? die_addr+0x3e/0x60\\n    [  560.880238]  ? exc_general_protection+0x1c5/0x410\\n    [  560.885532]  ? asm_exc_general_protection+0x27/0x30\\n    [  560.891025]  ? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu]\\n    [  560.898323]  amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu]\\n    [  560.904520]  process_one_work+0x228/0x3d0\\nHow:\\n    In RAS recovery, mode-1 reset is issued from RAS fatal error handling and expected\\n    all the nodes in a hive to be reset. no need to issue another mode-1 during this procedure.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/amdgpu: Omitir el restablecimiento de la ranura de error PCI durante la recuperaci\u00f3n de RAS Por qu\u00e9: El restablecimiento de la ranura de error PCI puede activarse despu\u00e9s de inyectar ue en UMC varias veces, lo que provoc\u00f3 que el sistema se bloqueara. [ 557.371857] amdgpu 0000:af:00.0: amdgpu: el reinicio de la GPU se realiz\u00f3 correctamente, intentando reanudar [ 557.373718] [drm] PCIE GART de 512M habilitado. [ 557.373722] [drm] PTB ubicado en 0x0000031FED700000 [ 557.373788] [drm] \u00a1La VRAM se pierde debido al reinicio de la GPU! [ 557.373789] [drm] PSP se est\u00e1 reanudando... [ 557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Estado del dispositivo = 1 pci_status: 0. Salir, resultado = 3, es necesario restablecer [ 557.547067] [drm] Error de PCI: devoluci\u00f3n de llamada detectada , estado(1)!! [ 557.547069] [drm] A\u00fan no hay soporte para XGMI hive... [ 557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Estado del dispositivo = 1 pci_status: 0. Ingrese [ 557.607763] mlx5_core 0000:55:00.0: espere el valor del contador vital 0x16b5b despu\u00e9s de 1 iteraci\u00f3n [557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Estado del dispositivo = 1 pci_status: 1. Salir, err = 0, resultado = 5, recuperado [557.610492] [drm] Error de PCI: \u00a1devoluci\u00f3n de llamada de restablecimiento de ranura! ... [ 560.689382] amdgpu 0000:3f:00.0: amdgpu: \u00a1El reinicio de GPU (2) se realiz\u00f3 correctamente! [ 560.689546] amdgpu 0000:5a:00.0: amdgpu: \u00a1El reinicio de GPU (2) se realiz\u00f3 correctamente! [ 560.689562] falla de protecci\u00f3n general, probablemente para direcci\u00f3n no can\u00f3nica 0x5f080b54534f611f: 0000 [#1] SMP NOPTI [ 560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G OE 5.15.0-91-generic # 101-Ubuntu [ 560.712057] Nombre de hardware: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 08/11/2023 [ 560.720959] Cola de trabajo: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu] [ 87] QEPD: 0010: amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] [ 560.736891] C\u00f3digo: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff \u0026lt;48\u0026gt; 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00 [ 560.757967] RSP: 0018:ffa0000032e53d80 00010202 [560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0 [ 560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010 [ 560.779867] BP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08 [ 560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 000 [560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000 [ 560.803889] FS: 0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000 [ 560.812973] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0 [ 560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 560.835433] DR3: 0000000000000000 DR6: 00000000ffe07f0 DR7: 0000000000000400 [ 560.843444] PKRU: 55555554 [ 560.846480] Seguimiento de llamadas: [ 560.849225]  [ 560.851580] ? show_trace_log_lvl+0x1d6/0x2ea [560.856488]? show_trace_log_lvl+0x1d6/0x2ea [560.861379]? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] [ 560.867778] ? show_regs.part.0+0x23/0x29 [560.872293]? __die_body.cold+0x8/0xd [ 560.876502] ? die_addr+0x3e/0x60 [ 560.880238] ? exc_general_protection+0x1c5/0x410 [560.885532]? asm_exc_general_protection+0x27/0x30 [560.891025]? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] [ 560.898323] amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] [ 560.904520] Process_one_work+0x228/0x3d0 C\u00f3mo: En la recuperaci\u00f3n de RAS, el restablecimiento del modo 1 se emite desde RAS fatal manejo de errores y esperaba todos los nodos en una colmena que se van a restablecer. no es necesario emitir otro modo-1 durante este procedimiento.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"395ca1031acf89d8ecb26127c544a71688d96f35\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"601429cca96b4af3be44172c3b64e4228515dbe1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.6\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:41:01.828598Z\",\"id\":\"CVE-2024-35931\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2\",\"versionEndExcluding\":\"6.8.6\",\"matchCriteriaId\":\"1EC15A0B-77F8-4BDC-B3CF-874F8B96AC53\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/395ca1031acf89d8ecb26127c544a71688d96f35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/395ca1031acf89d8ecb26127c544a71688d96f35\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:47:37+00:00",
      "cve": "CVE-2024-35931",
      "id": "CVE-2024-35931",
      "initial_release_date": "2024-05-19T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "22",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdgpu: Skip do PCI error slot reset during RAS recovery",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35931.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:50:13Z",
      "cve": "CVE-2024-35931",
      "id": "CVE-2024-35931",
      "initial_release_date": "2024-05-21T01:59:07Z",
      "product_status:known_affected": "532",
      "product_status:known_not_affected": "187",
      "product_status:recommended": "358",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35931",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35931.json",
      "version": "85"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/395ca1031acf89d8ecb26127c544a71688d96f35\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:49.006Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35931\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:41:01.828598Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:15.754Z\"}}], \"cna\": {\"title\": \"drm/amdgpu: Skip do PCI error slot reset during RAS recovery\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is the amdgpu PCI AER slot-reset callback racing the RAS recovery worker, reachable only from the local machine via GPU device access (`/dev/dri/renderD*` job submission causing poison consumption) or local debugfs RAS error injection. There is no remote or adjacent-network path to this driver code.\\nAC:L - The concurrency is not a narrow race the attacker must win by luck \\u2014 the RAS mode-1 reset itself generates the PCIe error that dispatches `amdgpu_pci_slot_reset()`, so one triggering event deterministically produces both overlapping reset paths, and the reporter reproduced it simply by repeating the trigger (\\\"inject ue to UMC multi times\\\"). An attacker who can reach the path can retry it indefinitely until the collision occurs.\\nPR:L - An unprivileged local user with GPU render-node access (standard for any user running compute workloads on an MI300 node) can drive the GPU into RAS recovery via poison-consumption interrupts from submitted work, and `amdgpu_ras_debugfs_ctrl_write()` contains no capability check of its own. No root or CAP_SYS_ADMIN check exists on the code path itself.\\nUI:N - No victim action is required; the corruption occurs entirely within kernel worker threads (`amdgpu-reset-hive` and the AER recovery thread) once the reset paths overlap.\\nS:U - The list corruption and the resulting memory access all occur within the host kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The stale list pointer causes `container_of()` to produce an attacker-influenceable `struct amdgpu_device *` derived from reused kernel stack memory, and the loop body then dereferences many fields through it \\u2014 an unbounded kernel-memory read primitive of the use-after-free class.\\nI:H - This is list corruption plus a dangling stack list head: `__list_add()` writes through the corrupted `prev`/`next` pointers, and the recovery loop writes through the bogus `tmp_adev` (`shutdown = true`, `atomic_inc(\u0026gpu_reset_counter)`, mp1-state and reset-domain updates), giving a write primitive at controllable offsets that is exploitable for control-flow hijacking.\\nA:H - The reported and reproducible outcome is a general protection fault on a non-canonical address inside a kernel workqueue during GPU reset, described by the reporter as hanging the system \\u2014 a full kernel crash/hang.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\", \"lessThan\": \"395ca1031acf89d8ecb26127c544a71688d96f35\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\", \"lessThan\": \"601429cca96b4af3be44172c3b64e4228515dbe1\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.8.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/395ca1031acf89d8ecb26127c544a71688d96f35\"}, {\"url\": \"https://git.kernel.org/stable/c/601429cca96b4af3be44172c3b64e4228515dbe1\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: Skip do PCI error slot reset during RAS recovery\\n\\nWhy:\\n    The PCI error slot reset maybe triggered after inject ue to UMC multi times, this\\n    caused system hang.\\n    [  557.371857] amdgpu 0000:af:00.0: amdgpu: GPU reset succeeded, trying to resume\\n    [  557.373718] [drm] PCIE GART of 512M enabled.\\n    [  557.373722] [drm] PTB located at 0x0000031FED700000\\n    [  557.373788] [drm] VRAM is lost due to GPU reset!\\n    [  557.373789] [drm] PSP is resuming...\\n    [  557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Device state = 1 pci_status: 0. Exit, result = 3, need reset\\n    [  557.547067] [drm] PCI error: detected callback, state(1)!!\\n    [  557.547069] [drm] No support for XGMI hive yet...\\n    [  557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 0. Enter\\n    [  557.607763] mlx5_core 0000:55:00.0: wait vital counter value 0x16b5b after 1 iterations\\n    [  557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 1. Exit, err = 0, result = 5, recovered\\n    [  557.610492] [drm] PCI error: slot reset callback!!\\n    ...\\n    [  560.689382] amdgpu 0000:3f:00.0: amdgpu: GPU reset(2) succeeded!\\n    [  560.689546] amdgpu 0000:5a:00.0: amdgpu: GPU reset(2) succeeded!\\n    [  560.689562] general protection fault, probably for non-canonical address 0x5f080b54534f611f: 0000 [#1] SMP NOPTI\\n    [  560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G           OE     5.15.0-91-generic #101-Ubuntu\\n    [  560.712057] Hardware name: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 11/08/2023\\n    [  560.720959] Workqueue: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu]\\n    [  560.728887] RIP: 0010:amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu]\\n    [  560.736891] Code: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff \u003c48\u003e 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00\\n    [  560.757967] RSP: 0018:ffa0000032e53d80 EFLAGS: 00010202\\n    [  560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0\\n    [  560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010\\n    [  560.779867] RBP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08\\n    [  560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 0000000000000000\\n    [  560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000\\n    [  560.803889] FS:  0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000\\n    [  560.812973] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n    [  560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0\\n    [  560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n    [  560.835433] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\\n    [  560.843444] PKRU: 55555554\\n    [  560.846480] Call Trace:\\n    [  560.849225]  \u003cTASK\u003e\\n    [  560.851580]  ? show_trace_log_lvl+0x1d6/0x2ea\\n    [  560.856488]  ? show_trace_log_lvl+0x1d6/0x2ea\\n    [  560.861379]  ? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu]\\n    [  560.867778]  ? show_regs.part.0+0x23/0x29\\n    [  560.872293]  ? __die_body.cold+0x8/0xd\\n    [  560.876502]  ? die_addr+0x3e/0x60\\n    [  560.880238]  ? exc_general_protection+0x1c5/0x410\\n    [  560.885532]  ? asm_exc_general_protection+0x27/0x30\\n    [  560.891025]  ? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu]\\n    [  560.898323]  amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu]\\n    [  560.904520]  process_one_work+0x228/0x3d0\\nHow:\\n    In RAS recovery, mode-1 reset is issued from RAS fatal error handling and expected\\n    all the nodes in a hive to be reset. no need to issue another mode-1 during this procedure.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.6\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"4.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:02.773Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35931\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:02.773Z\", \"dateReserved\": \"2024-05-17T13:50:33.129Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-19T10:10:39.706Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.