CVE-2024-46710 (GCVE-0-2024-46710)

Vulnerability from cvelistv5 – Published: 2024-09-13 06:33 – Updated: 2026-08-05 11:38
VLAI
Title
drm/vmwgfx: Prevent unmapping active read buffers
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Prevent unmapping active read buffers The kms paths keep a persistent map active to read and compare the cursor buffer. These maps can race with each other in simple scenario where: a) buffer "a" mapped for update b) buffer "a" mapped for compare c) do the compare d) unmap "a" for compare e) update the cursor f) unmap "a" for update At step "e" the buffer has been unmapped and the read contents is bogus. Prevent unmapping of active read buffers by simply keeping a count of how many paths have currently active maps and unmap only when the count reaches 0.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 485d98d472d53f9617ffdfba5e677ac29ad4fe20 , < 58a3714db4d9dcaeb9fc4905141e17b9f536c0a5 (git)
Affected: 485d98d472d53f9617ffdfba5e677ac29ad4fe20 , < 0851b1ec650adadcaa23ec96daad95a55bf966f0 (git)
Affected: 485d98d472d53f9617ffdfba5e677ac29ad4fe20 , < d5228d158e4c0b1663b3983044913c15c3d0135e (git)
Affected: 485d98d472d53f9617ffdfba5e677ac29ad4fe20 , < aba07b9a0587f50e5d3346eaa19019cf3f86c0ea (git)
Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.8 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46710",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:59:47.963109Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:00:04.356Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:16:37.924Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c",
            "drivers/gpu/drm/vmwgfx/vmwgfx_bo.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "58a3714db4d9dcaeb9fc4905141e17b9f536c0a5",
              "status": "affected",
              "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20",
              "versionType": "git"
            },
            {
              "lessThan": "0851b1ec650adadcaa23ec96daad95a55bf966f0",
              "status": "affected",
              "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20",
              "versionType": "git"
            },
            {
              "lessThan": "d5228d158e4c0b1663b3983044913c15c3d0135e",
              "status": "affected",
              "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20",
              "versionType": "git"
            },
            {
              "lessThan": "aba07b9a0587f50e5d3346eaa19019cf3f86c0ea",
              "status": "affected",
              "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c",
            "drivers/gpu/drm/vmwgfx/vmwgfx_bo.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.8",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Prevent unmapping active read buffers\n\nThe kms paths keep a persistent map active to read and compare the cursor\nbuffer. These maps can race with each other in simple scenario where:\na) buffer \"a\" mapped for update\nb) buffer \"a\" mapped for compare\nc) do the compare\nd) unmap \"a\" for compare\ne) update the cursor\nf) unmap \"a\" for update\nAt step \"e\" the buffer has been unmapped and the read contents is bogus.\n\nPrevent unmapping of active read buffers by simply keeping a count of\nhow many paths have currently active maps and unmap only when the count\nreaches 0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only route to the racing map/unmap pairs is the DRM cursor/atomic-commit ioctl path on /dev/dri/card* (`drm_mode_cursor_ioctl`, `drm_mode_atomic_ioctl`) plus the vmwgfx VKMS CRC worker, all of which require a local open of the GPU device node. No network, adjacent-network, or physical-bus data reaches this code.\nAC:L - The attacker controls both sides of the race \u2014 vmwgfx exposes 8 cursor planes, so the same GEM-backed cursor framebuffer can be bound to several planes and hammered from concurrent threads, with `prepare_fb` mapping while another CRTC\u0027s `cleanup_fb`/`vmw_user_object_unmap` tears the shared cached map down. The window can be retried without limit and no attacker-uncontrollable precondition exists.\nPR:L - The ioctls are gated only on DRM master, not on any capability; a locally logged-in user receives the card node via logind ACL (or `video` group) and becomes master on open when no compositor holds it, which is the normal case on a headless or console-only VMware guest. Real root in the initial namespace is not needed.\nUI:N - The attacker performs every step itself \u2014 allocating the dumb buffer, binding it as a cursor framebuffer, and issuing the concurrent cursor/atomic commits. No victim action or cooperating process is required.\nS:U - The corrupted vmalloc range and the leaked data both belong to the same guest kernel that hosts the vulnerable driver, so the impact stays within one security authority. Being a paravirtual guest driver does not let this cross into the hypervisor.\nC:H - After `vunmap()` the cached virtual address can be reused by any other vmalloc allocation, and the read paths (`memcmp` in `vmw_du_cursor_plane_has_changed`, the 16 KB `memcpy` source in `vmw_cursor_update_mob`, and `crc32_le` in `compute_crc`) then pull that reclaimed kernel memory into the displayed cursor image or a userspace-visible CRC. This is a stale-mapping read of effectively arbitrary kernel memory, not a bounded leak.\nI:H - `vmw_cursor_update_mob()` performs `memset(header, 0, ...)` and a 16 KB `memcpy` of fully attacker-controlled dumb-buffer pixel data through the stale mapping, writing chosen bytes into whatever vmalloc allocation reclaimed that address range. With CONFIG_VMAP_STACK the same 16 KB granularity is used for kernel thread stacks, giving a realistic path to control-flow hijack.\nA:H - If the purged vmap area has not been reused, the subsequent read or write dereferences unmapped kernel virtual addresses, producing an immediate kernel page fault/oops; if it has been reused, the 16 KB overwrite corrupts unrelated kernel state and panics the system. Either outcome is a full crash, and it is repeatable on demand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:05.250Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/58a3714db4d9dcaeb9fc4905141e17b9f536c0a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/0851b1ec650adadcaa23ec96daad95a55bf966f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5228d158e4c0b1663b3983044913c15c3d0135e"
        },
        {
          "url": "https://git.kernel.org/stable/c/aba07b9a0587f50e5d3346eaa19019cf3f86c0ea"
        }
      ],
      "title": "drm/vmwgfx: Prevent unmapping active read buffers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46710",
    "datePublished": "2024-09-13T06:33:42.285Z",
    "dateReserved": "2024-09-11T15:12:18.252Z",
    "dateUpdated": "2026-08-05T11:38:05.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46710",
      "date": "2026-08-09",
      "epss": "0.00226",
      "percentile": "0.13288"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.19\", \"versionEndExcluding\": \"6.10.8\", \"matchCriteriaId\": \"DA05BB16-4465-46ED-A5AB-5CDE73240EA3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: Prevent unmapping active read buffers\\n\\nThe kms paths keep a persistent map active to read and compare the cursor\\nbuffer. These maps can race with each other in simple scenario where:\\na) buffer \\\"a\\\" mapped for update\\nb) buffer \\\"a\\\" mapped for compare\\nc) do the compare\\nd) unmap \\\"a\\\" for compare\\ne) update the cursor\\nf) unmap \\\"a\\\" for update\\nAt step \\\"e\\\" the buffer has been unmapped and the read contents is bogus.\\n\\nPrevent unmapping of active read buffers by simply keeping a count of\\nhow many paths have currently active maps and unmap only when the count\\nreaches 0.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/vmwgfx: evitar la desasignaci\\u00f3n de b\\u00faferes de lectura activos Las rutas kms mantienen activo un mapa persistente para leer y comparar el b\\u00fafer del cursor. Estos mapas pueden competir entre s\\u00ed en un escenario simple donde: a) b\\u00fafer \\\"a\\\" mapeado para actualizaci\\u00f3n b) b\\u00fafer \\\"a\\\" mapeado para comparaci\\u00f3n c) hacer la comparaci\\u00f3n d) desasignar \\\"a\\\" para comparaci\\u00f3n e) actualizar el cursor f) desasignar \\\"a\\\" para actualizaci\\u00f3n En el paso \\\"e\\\", el b\\u00fafer ha sido desasignado y el contenido de lectura es falso. Evite la desasignaci\\u00f3n de b\\u00faferes de lectura activos simplemente llevando un recuento de cu\\u00e1ntas rutas tienen mapas activos actualmente y desasign\\u00e1ndolos solo cuando el recuento llegue a 0.\"}]",
      "id": "CVE-2024-46710",
      "lastModified": "2024-10-17T14:15:07.630",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 3.6}]}",
      "published": "2024-09-13T07:15:05.880",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0851b1ec650adadcaa23ec96daad95a55bf966f0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/58a3714db4d9dcaeb9fc4905141e17b9f536c0a5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/aba07b9a0587f50e5d3346eaa19019cf3f86c0ea\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d5228d158e4c0b1663b3983044913c15c3d0135e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T01:25:24.000Z",
      "cve": "CVE-2024-46710",
      "id": "msrc_CVE-2024-46710",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/vmwgfx: Prevent unmapping active read buffers",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46710.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46710\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-13T07:15:05.880\",\"lastModified\":\"2026-08-04T11:20:17.337\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: Prevent unmapping active read buffers\\n\\nThe kms paths keep a persistent map active to read and compare the cursor\\nbuffer. These maps can race with each other in simple scenario where:\\na) buffer \\\"a\\\" mapped for update\\nb) buffer \\\"a\\\" mapped for compare\\nc) do the compare\\nd) unmap \\\"a\\\" for compare\\ne) update the cursor\\nf) unmap \\\"a\\\" for update\\nAt step \\\"e\\\" the buffer has been unmapped and the read contents is bogus.\\n\\nPrevent unmapping of active read buffers by simply keeping a count of\\nhow many paths have currently active maps and unmap only when the count\\nreaches 0.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/vmwgfx: evitar la desasignaci\u00f3n de b\u00faferes de lectura activos Las rutas kms mantienen activo un mapa persistente para leer y comparar el b\u00fafer del cursor. Estos mapas pueden competir entre s\u00ed en un escenario simple donde: a) b\u00fafer \\\"a\\\" mapeado para actualizaci\u00f3n b) b\u00fafer \\\"a\\\" mapeado para comparaci\u00f3n c) hacer la comparaci\u00f3n d) desasignar \\\"a\\\" para comparaci\u00f3n e) actualizar el cursor f) desasignar \\\"a\\\" para actualizaci\u00f3n En el paso \\\"e\\\", el b\u00fafer ha sido desasignado y el contenido de lectura es falso. Evite la desasignaci\u00f3n de b\u00faferes de lectura activos simplemente llevando un recuento de cu\u00e1ntas rutas tienen mapas activos actualmente y desasign\u00e1ndolos solo cuando el recuento llegue a 0.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/vmwgfx/vmwgfx_bo.c\",\"drivers/gpu/drm/vmwgfx/vmwgfx_bo.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"485d98d472d53f9617ffdfba5e677ac29ad4fe20\",\"lessThan\":\"58a3714db4d9dcaeb9fc4905141e17b9f536c0a5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"485d98d472d53f9617ffdfba5e677ac29ad4fe20\",\"lessThan\":\"0851b1ec650adadcaa23ec96daad95a55bf966f0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"485d98d472d53f9617ffdfba5e677ac29ad4fe20\",\"lessThan\":\"d5228d158e4c0b1663b3983044913c15c3d0135e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"485d98d472d53f9617ffdfba5e677ac29ad4fe20\",\"lessThan\":\"aba07b9a0587f50e5d3346eaa19019cf3f86c0ea\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/vmwgfx/vmwgfx_bo.c\",\"drivers/gpu/drm/vmwgfx/vmwgfx_bo.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.54\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.8\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T14:59:47.963109Z\",\"id\":\"CVE-2024-46710\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"6.10.8\",\"matchCriteriaId\":\"DA05BB16-4465-46ED-A5AB-5CDE73240EA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0851b1ec650adadcaa23ec96daad95a55bf966f0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/58a3714db4d9dcaeb9fc4905141e17b9f536c0a5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aba07b9a0587f50e5d3346eaa19019cf3f86c0ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d5228d158e4c0b1663b3983044913c15c3d0135e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:41:37+00:00",
      "cve": "CVE-2024-46710",
      "id": "CVE-2024-46710",
      "initial_release_date": "2024-09-13T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/vmwgfx: Prevent unmapping active read buffers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46710.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:52:54Z",
      "cve": "CVE-2024-46710",
      "id": "CVE-2024-46710",
      "initial_release_date": "2024-09-14T02:50:51Z",
      "product_status:known_affected": "473",
      "product_status:known_not_affected": "277",
      "product_status:recommended": "357",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-46710",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46710.json",
      "version": "68"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:16:37.924Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46710\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:59:47.963109Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:59:52.072Z\"}}], \"cna\": {\"title\": \"drm/vmwgfx: Prevent unmapping active read buffers\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The only route to the racing map/unmap pairs is the DRM cursor/atomic-commit ioctl path on /dev/dri/card* (`drm_mode_cursor_ioctl`, `drm_mode_atomic_ioctl`) plus the vmwgfx VKMS CRC worker, all of which require a local open of the GPU device node. No network, adjacent-network, or physical-bus data reaches this code.\\nAC:L - The attacker controls both sides of the race \\u2014 vmwgfx exposes 8 cursor planes, so the same GEM-backed cursor framebuffer can be bound to several planes and hammered from concurrent threads, with `prepare_fb` mapping while another CRTC\u0027s `cleanup_fb`/`vmw_user_object_unmap` tears the shared cached map down. The window can be retried without limit and no attacker-uncontrollable precondition exists.\\nPR:L - The ioctls are gated only on DRM master, not on any capability; a locally logged-in user receives the card node via logind ACL (or `video` group) and becomes master on open when no compositor holds it, which is the normal case on a headless or console-only VMware guest. Real root in the initial namespace is not needed.\\nUI:N - The attacker performs every step itself \\u2014 allocating the dumb buffer, binding it as a cursor framebuffer, and issuing the concurrent cursor/atomic commits. No victim action or cooperating process is required.\\nS:U - The corrupted vmalloc range and the leaked data both belong to the same guest kernel that hosts the vulnerable driver, so the impact stays within one security authority. Being a paravirtual guest driver does not let this cross into the hypervisor.\\nC:H - After `vunmap()` the cached virtual address can be reused by any other vmalloc allocation, and the read paths (`memcmp` in `vmw_du_cursor_plane_has_changed`, the 16 KB `memcpy` source in `vmw_cursor_update_mob`, and `crc32_le` in `compute_crc`) then pull that reclaimed kernel memory into the displayed cursor image or a userspace-visible CRC. This is a stale-mapping read of effectively arbitrary kernel memory, not a bounded leak.\\nI:H - `vmw_cursor_update_mob()` performs `memset(header, 0, ...)` and a 16 KB `memcpy` of fully attacker-controlled dumb-buffer pixel data through the stale mapping, writing chosen bytes into whatever vmalloc allocation reclaimed that address range. With CONFIG_VMAP_STACK the same 16 KB granularity is used for kernel thread stacks, giving a realistic path to control-flow hijack.\\nA:H - If the purged vmap area has not been reused, the subsequent read or write dereferences unmapped kernel virtual addresses, producing an immediate kernel page fault/oops; if it has been reused, the 16 KB overwrite corrupts unrelated kernel state and panics the system. Either outcome is a full crash, and it is repeatable on demand.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"485d98d472d53f9617ffdfba5e677ac29ad4fe20\", \"lessThan\": \"58a3714db4d9dcaeb9fc4905141e17b9f536c0a5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"485d98d472d53f9617ffdfba5e677ac29ad4fe20\", \"lessThan\": \"0851b1ec650adadcaa23ec96daad95a55bf966f0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"485d98d472d53f9617ffdfba5e677ac29ad4fe20\", \"lessThan\": \"d5228d158e4c0b1663b3983044913c15c3d0135e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"485d98d472d53f9617ffdfba5e677ac29ad4fe20\", \"lessThan\": \"aba07b9a0587f50e5d3346eaa19019cf3f86c0ea\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/vmwgfx/vmwgfx_bo.c\", \"drivers/gpu/drm/vmwgfx/vmwgfx_bo.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/vmwgfx/vmwgfx_bo.c\", \"drivers/gpu/drm/vmwgfx/vmwgfx_bo.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/58a3714db4d9dcaeb9fc4905141e17b9f536c0a5\"}, {\"url\": \"https://git.kernel.org/stable/c/0851b1ec650adadcaa23ec96daad95a55bf966f0\"}, {\"url\": \"https://git.kernel.org/stable/c/d5228d158e4c0b1663b3983044913c15c3d0135e\"}, {\"url\": \"https://git.kernel.org/stable/c/aba07b9a0587f50e5d3346eaa19019cf3f86c0ea\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: Prevent unmapping active read buffers\\n\\nThe kms paths keep a persistent map active to read and compare the cursor\\nbuffer. These maps can race with each other in simple scenario where:\\na) buffer \\\"a\\\" mapped for update\\nb) buffer \\\"a\\\" mapped for compare\\nc) do the compare\\nd) unmap \\\"a\\\" for compare\\ne) update the cursor\\nf) unmap \\\"a\\\" for update\\nAt step \\\"e\\\" the buffer has been unmapped and the read contents is bogus.\\n\\nPrevent unmapping of active read buffers by simply keeping a count of\\nhow many paths have currently active maps and unmap only when the count\\nreaches 0.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.8\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.19\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:38:05.250Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46710\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:38:05.250Z\", \"dateReserved\": \"2024-09-11T15:12:18.252Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-13T06:33:42.285Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.