CVE-2024-36018 (GCVE-0-2024-36018)

Vulnerability from cvelistv5 – Published: 2024-05-30 14:59 – Updated: 2026-08-05 11:31
VLAI
Title
nouveau/uvmm: fix addr/range calcs for remap operations
Summary
In the Linux kernel, the following vulnerability has been resolved: nouveau/uvmm: fix addr/range calcs for remap operations dEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8 was causing a remap operation like the below. op_remap: prev: 0000003fffed0000 00000000000f0000 00000000a5abd18a 0000000000000000 op_remap: next: op_remap: unmap: 0000003fffed0000 0000000000100000 0 op_map: map: 0000003ffffc0000 0000000000010000 000000005b1ba33c 00000000000e0000 This was resulting in an unmap operation from 0x3fffed0000+0xf0000, 0x100000 which was corrupting the pagetables and oopsing the kernel. Fixes the prev + unmap range calcs to use start/end and map back to addr/range.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b88baab828713ce0b49b185444b2ee83bed373a8 , < 692a51bebf4552bdf0a79ccd68d291182a26a569 (git)
Affected: b88baab828713ce0b49b185444b2ee83bed373a8 , < 0c16020d2b69a602c8ae6a1dd2aac9a3023249d6 (git)
Affected: b88baab828713ce0b49b185444b2ee83bed373a8 , < be141849ec00ef39935bf169c0f194ac70bf85ce (git)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.26 , ≤ 6.6.* (semver)
Unaffected: 6.8.5 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36018",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-06T18:34:51.763969Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-06T18:35:02.091Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:12.600Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/692a51bebf4552bdf0a79ccd68d291182a26a569"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0c16020d2b69a602c8ae6a1dd2aac9a3023249d6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/be141849ec00ef39935bf169c0f194ac70bf85ce"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/nouveau/nouveau_uvmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "692a51bebf4552bdf0a79ccd68d291182a26a569",
              "status": "affected",
              "version": "b88baab828713ce0b49b185444b2ee83bed373a8",
              "versionType": "git"
            },
            {
              "lessThan": "0c16020d2b69a602c8ae6a1dd2aac9a3023249d6",
              "status": "affected",
              "version": "b88baab828713ce0b49b185444b2ee83bed373a8",
              "versionType": "git"
            },
            {
              "lessThan": "be141849ec00ef39935bf169c0f194ac70bf85ce",
              "status": "affected",
              "version": "b88baab828713ce0b49b185444b2ee83bed373a8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/nouveau/nouveau_uvmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau/uvmm: fix addr/range calcs for remap operations\n\ndEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8\nwas causing a remap operation like the below.\n\nop_remap: prev: 0000003fffed0000 00000000000f0000 00000000a5abd18a 0000000000000000\nop_remap: next:\nop_remap: unmap: 0000003fffed0000 0000000000100000 0\nop_map: map: 0000003ffffc0000 0000000000010000 000000005b1ba33c 00000000000e0000\n\nThis was resulting in an unmap operation from 0x3fffed0000+0xf0000, 0x100000\nwhich was corrupting the pagetables and oopsing the kernel.\n\nFixes the prev + unmap range calcs to use start/end and map back to addr/range."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered through the DRM_IOCTL_NOUVEAU_VM_BIND ioctl on a nouveau DRM device node; no network or remote reachability is involved.\nAC:L - The attacker fully controls the VA layout that produces a prev-only remap (map a range, then map over its tail), making the overshoot amount and target address deterministic; it reproduces from a stock Vulkan CTS test with no race or unknown state.\nPR:L - The ioctl is registered DRM_RENDER_ALLOW, so it works on an unauthenticated render node (/dev/dri/renderD*), which unprivileged desktop users hold via logind ACLs or the render group and which is routinely exposed to containers and GPU sandboxes.\nUI:N - The attacking process performs VM_INIT and VM_BIND entirely on its own file descriptor; no victim action or interaction is required.\nS:U - The corrupted GPU page tables and the resulting memory access are managed by the same kernel security authority; there is no VM, IOMMU, or hypervisor boundary crossed.\nC:H - Because the over-long unmap is silently dropped with -EINVAL when it crosses the managed-range boundary while cleanup still drops the BO reference, the GPU retains valid mappings on freed pages that get recycled to other processes and the kernel, giving the attacker\u0027s shaders an arbitrary read primitive.\nI:H - The bug performs an attacker-sized, attacker-placed PTE clear outside the intended range, corrupting live GPU page-table entries behind drm_gpuvm\u0027s bookkeeping, and the stale-mapping case leaves writable GPU DMA access to reallocated kernel memory.\nA:H - The reported symptom is a kernel oops \u2014 nvkm_vmm_iter() omits the NVKM_VMM_PDE_INVALID check on the unmap path, so walking into an unbacked or sparse PDE dereferences NULL or ERR_PTR(-EBUSY), and an unprivileged process can trigger it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:38.174Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/692a51bebf4552bdf0a79ccd68d291182a26a569"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c16020d2b69a602c8ae6a1dd2aac9a3023249d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/be141849ec00ef39935bf169c0f194ac70bf85ce"
        }
      ],
      "title": "nouveau/uvmm: fix addr/range calcs for remap operations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36018",
    "datePublished": "2024-05-30T14:59:42.091Z",
    "dateReserved": "2024-05-17T13:50:33.155Z",
    "dateUpdated": "2026-08-05T11:31:38.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36018",
      "date": "2026-08-05",
      "epss": "0.00231",
      "percentile": "0.14023"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnouveau/uvmm: fix addr/range calcs for remap operations\\n\\ndEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8\\nwas causing a remap operation like the below.\\n\\nop_remap: prev: 0000003fffed0000 00000000000f0000 00000000a5abd18a 0000000000000000\\nop_remap: next:\\nop_remap: unmap: 0000003fffed0000 0000000000100000 0\\nop_map: map: 0000003ffffc0000 0000000000010000 000000005b1ba33c 00000000000e0000\\n\\nThis was resulting in an unmap operation from 0x3fffed0000+0xf0000, 0x100000\\nwhich was corrupting the pagetables and oopsing the kernel.\\n\\nFixes the prev + unmap range calcs to use start/end and map back to addr/range.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: nouveau/uvmm: corrige los c\\u00e1lculos de addr/range para operaciones de reasignaci\\u00f3n dEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8 estaba provocando una operaci\\u00f3n de reasignaci\\u00f3n como la siguiente. OP_REMAP: Prev: 0000003FFED0000 00000000000F0000 0000000000A5ABD18A 0000000000000000 OP_REMAP: SIGUIEN 0000000000000E0000 Esto dio como resultado una operaci\\u00f3n de UNMAP desde 0x3fffed0000+0xf0000, 0x100000, que corromp\\u00eda los pagetables y se agotaba el n\\u00facleo. Corrige los c\\u00e1lculos de rango anterior + desasignar para usar inicio/fin y volver a asignar a direcci\\u00f3n/rango.\"}]",
      "id": "CVE-2024-36018",
      "lastModified": "2024-11-21T09:21:26.853",
      "published": "2024-05-30T15:15:48.950",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0c16020d2b69a602c8ae6a1dd2aac9a3023249d6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/692a51bebf4552bdf0a79ccd68d291182a26a569\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/be141849ec00ef39935bf169c0f194ac70bf85ce\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0c16020d2b69a602c8ae6a1dd2aac9a3023249d6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/692a51bebf4552bdf0a79ccd68d291182a26a569\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/be141849ec00ef39935bf169c0f194ac70bf85ce\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36018\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T15:15:48.950\",\"lastModified\":\"2026-08-04T11:18:23.230\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnouveau/uvmm: fix addr/range calcs for remap operations\\n\\ndEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8\\nwas causing a remap operation like the below.\\n\\nop_remap: prev: 0000003fffed0000 00000000000f0000 00000000a5abd18a 0000000000000000\\nop_remap: next:\\nop_remap: unmap: 0000003fffed0000 0000000000100000 0\\nop_map: map: 0000003ffffc0000 0000000000010000 000000005b1ba33c 00000000000e0000\\n\\nThis was resulting in an unmap operation from 0x3fffed0000+0xf0000, 0x100000\\nwhich was corrupting the pagetables and oopsing the kernel.\\n\\nFixes the prev + unmap range calcs to use start/end and map back to addr/range.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: nouveau/uvmm: corrige los c\u00e1lculos de addr/range para operaciones de reasignaci\u00f3n dEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8 estaba provocando una operaci\u00f3n de reasignaci\u00f3n como la siguiente. OP_REMAP: Prev: 0000003FFED0000 00000000000F0000 0000000000A5ABD18A 0000000000000000 OP_REMAP: SIGUIEN 0000000000000E0000 Esto dio como resultado una operaci\u00f3n de UNMAP desde 0x3fffed0000+0xf0000, 0x100000, que corromp\u00eda los pagetables y se agotaba el n\u00facleo. Corrige los c\u00e1lculos de rango anterior + desasignar para usar inicio/fin y volver a asignar a direcci\u00f3n/rango.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/nouveau/nouveau_uvmm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b88baab828713ce0b49b185444b2ee83bed373a8\",\"lessThan\":\"692a51bebf4552bdf0a79ccd68d291182a26a569\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b88baab828713ce0b49b185444b2ee83bed373a8\",\"lessThan\":\"0c16020d2b69a602c8ae6a1dd2aac9a3023249d6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b88baab828713ce0b49b185444b2ee83bed373a8\",\"lessThan\":\"be141849ec00ef39935bf169c0f194ac70bf85ce\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/nouveau/nouveau_uvmm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.26\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.5\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-06T18:34:51.763969Z\",\"id\":\"CVE-2024-36018\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.26\",\"matchCriteriaId\":\"820B6E76-73EC-4D11-9B47-9B84788379A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.5\",\"matchCriteriaId\":\"DBD6C99E-4250-4DFE-8447-FF2075939D10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c16020d2b69a602c8ae6a1dd2aac9a3023249d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/692a51bebf4552bdf0a79ccd68d291182a26a569\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/be141849ec00ef39935bf169c0f194ac70bf85ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0c16020d2b69a602c8ae6a1dd2aac9a3023249d6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/692a51bebf4552bdf0a79ccd68d291182a26a569\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/be141849ec00ef39935bf169c0f194ac70bf85ce\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:46:36+00:00",
      "cve": "CVE-2024-36018",
      "id": "CVE-2024-36018",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nouveau/uvmm: fix addr/range calcs for remap operations",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36018.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:57:57Z",
      "cve": "CVE-2024-36018",
      "id": "CVE-2024-36018",
      "initial_release_date": "2024-06-01T02:24:13Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "270",
      "product_status:recommended": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36018",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36018.json",
      "version": "77"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/692a51bebf4552bdf0a79ccd68d291182a26a569\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0c16020d2b69a602c8ae6a1dd2aac9a3023249d6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/be141849ec00ef39935bf169c0f194ac70bf85ce\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:30:12.600Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36018\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-06T18:34:51.763969Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-06T18:34:57.767Z\"}}], \"cna\": {\"title\": \"nouveau/uvmm: fix addr/range calcs for remap operations\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Triggered through the DRM_IOCTL_NOUVEAU_VM_BIND ioctl on a nouveau DRM device node; no network or remote reachability is involved.\\nAC:L - The attacker fully controls the VA layout that produces a prev-only remap (map a range, then map over its tail), making the overshoot amount and target address deterministic; it reproduces from a stock Vulkan CTS test with no race or unknown state.\\nPR:L - The ioctl is registered DRM_RENDER_ALLOW, so it works on an unauthenticated render node (/dev/dri/renderD*), which unprivileged desktop users hold via logind ACLs or the render group and which is routinely exposed to containers and GPU sandboxes.\\nUI:N - The attacking process performs VM_INIT and VM_BIND entirely on its own file descriptor; no victim action or interaction is required.\\nS:U - The corrupted GPU page tables and the resulting memory access are managed by the same kernel security authority; there is no VM, IOMMU, or hypervisor boundary crossed.\\nC:H - Because the over-long unmap is silently dropped with -EINVAL when it crosses the managed-range boundary while cleanup still drops the BO reference, the GPU retains valid mappings on freed pages that get recycled to other processes and the kernel, giving the attacker\u0027s shaders an arbitrary read primitive.\\nI:H - The bug performs an attacker-sized, attacker-placed PTE clear outside the intended range, corrupting live GPU page-table entries behind drm_gpuvm\u0027s bookkeeping, and the stale-mapping case leaves writable GPU DMA access to reallocated kernel memory.\\nA:H - The reported symptom is a kernel oops \\u2014 nvkm_vmm_iter() omits the NVKM_VMM_PDE_INVALID check on the unmap path, so walking into an unbacked or sparse PDE dereferences NULL or ERR_PTR(-EBUSY), and an unprivileged process can trigger it at will.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b88baab828713ce0b49b185444b2ee83bed373a8\", \"lessThan\": \"692a51bebf4552bdf0a79ccd68d291182a26a569\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b88baab828713ce0b49b185444b2ee83bed373a8\", \"lessThan\": \"0c16020d2b69a602c8ae6a1dd2aac9a3023249d6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b88baab828713ce0b49b185444b2ee83bed373a8\", \"lessThan\": \"be141849ec00ef39935bf169c0f194ac70bf85ce\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/nouveau/nouveau_uvmm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.26\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/nouveau/nouveau_uvmm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/692a51bebf4552bdf0a79ccd68d291182a26a569\"}, {\"url\": \"https://git.kernel.org/stable/c/0c16020d2b69a602c8ae6a1dd2aac9a3023249d6\"}, {\"url\": \"https://git.kernel.org/stable/c/be141849ec00ef39935bf169c0f194ac70bf85ce\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnouveau/uvmm: fix addr/range calcs for remap operations\\n\\ndEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8\\nwas causing a remap operation like the below.\\n\\nop_remap: prev: 0000003fffed0000 00000000000f0000 00000000a5abd18a 0000000000000000\\nop_remap: next:\\nop_remap: unmap: 0000003fffed0000 0000000000100000 0\\nop_map: map: 0000003ffffc0000 0000000000010000 000000005b1ba33c 00000000000e0000\\n\\nThis was resulting in an unmap operation from 0x3fffed0000+0xf0000, 0x100000\\nwhich was corrupting the pagetables and oopsing the kernel.\\n\\nFixes the prev + unmap range calcs to use start/end and map back to addr/range.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.26\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:38.174Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36018\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:38.174Z\", \"dateReserved\": \"2024-05-17T13:50:33.155Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T14:59:42.091Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.