CVE-2024-49992 (GCVE-0-2024-49992)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:02 – Updated: 2026-08-05 11:40
VLAI
Title
drm/stm: Avoid use-after-free issues with crtc and plane
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/stm: Avoid use-after-free issues with crtc and plane ltdc_load() calls functions drm_crtc_init_with_planes(), drm_universal_plane_init() and drm_encoder_init(). These functions should not be called with parameters allocated with devm_kzalloc() to avoid use-after-free issues [1]. Use allocations managed by the DRM framework. Found by Linux Verification Center (linuxtesting.org). [1] https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b759012c5fa761ee08998c80fc4ad6343c258487 , < d02611ff001454358be6910cb926799e2d818716 (git)
Affected: b759012c5fa761ee08998c80fc4ad6343c258487 , < 0a1741d10da29aa84955ef89ae9a03c4b6038657 (git)
Affected: b759012c5fa761ee08998c80fc4ad6343c258487 , < 454e5d7e671946698af0f201e48469e5ddb42851 (git)
Affected: b759012c5fa761ee08998c80fc4ad6343c258487 , < b22eec4b57d04befa90e8554ede34e6c67257606 (git)
Affected: b759012c5fa761ee08998c80fc4ad6343c258487 , < 19dd9780b7ac673be95bf6fd6892a184c9db611f (git)
Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.55 , ≤ 6.6.* (semver)
Unaffected: 6.10.14 , ≤ 6.10.* (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49992",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:31:07.009365Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:38:42.528Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:24:11.293Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/stm/drv.c",
            "drivers/gpu/drm/stm/ltdc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d02611ff001454358be6910cb926799e2d818716",
              "status": "affected",
              "version": "b759012c5fa761ee08998c80fc4ad6343c258487",
              "versionType": "git"
            },
            {
              "lessThan": "0a1741d10da29aa84955ef89ae9a03c4b6038657",
              "status": "affected",
              "version": "b759012c5fa761ee08998c80fc4ad6343c258487",
              "versionType": "git"
            },
            {
              "lessThan": "454e5d7e671946698af0f201e48469e5ddb42851",
              "status": "affected",
              "version": "b759012c5fa761ee08998c80fc4ad6343c258487",
              "versionType": "git"
            },
            {
              "lessThan": "b22eec4b57d04befa90e8554ede34e6c67257606",
              "status": "affected",
              "version": "b759012c5fa761ee08998c80fc4ad6343c258487",
              "versionType": "git"
            },
            {
              "lessThan": "19dd9780b7ac673be95bf6fd6892a184c9db611f",
              "status": "affected",
              "version": "b759012c5fa761ee08998c80fc4ad6343c258487",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/stm/drv.c",
            "drivers/gpu/drm/stm/ltdc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/stm: Avoid use-after-free issues with crtc and plane\n\nltdc_load() calls functions drm_crtc_init_with_planes(),\ndrm_universal_plane_init() and drm_encoder_init(). These functions\nshould not be called with parameters allocated with devm_kzalloc()\nto avoid use-after-free issues [1].\n\nUse allocations managed by the DRM framework.\n\nFound by Linux Verification Center (linuxtesting.org).\n\n[1]\nhttps://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable objects are reached through the local DRM character device `/dev/dri/card0` \u2014 via modeset ioctls on an already-open fd and via the `close()`-driven `drm_dev_release()` path \u2014 with the free triggered by local platform-driver unbind/module removal. There is no network or remote-peer input to the STM32 LTDC display controller.\nAC:L - There is no race to win: once the platform device is unbound, `devres_release_all()` deterministically frees the `drm_crtc`/`drm_plane`/`drm_encoder`/panel-bridge `drm_connector` while the objects remain linked in `mode_config`\u0027s lists and `object_idr`, and the attacker alone decides when to spray the general-purpose kmalloc slab and when to close the fd that runs `drm_mode_config_cleanup()` on the freed memory. No attacker-uninfluenceable memory layout or system state is required.\nPR:L - Every step the attacker performs needs only an ordinary local account with access to the DRM node \u2014 `DRM_IOCTL_MODE_GETRESOURCES`/`GETCRTC`/`GETPLANE`/`GETCONNECTOR` are registered with flags `0` (no `DRM_MASTER`, no `DRM_AUTH`, no capability check), and the `close()` path that dereferences the freed objects checks nothing at all. The freeing event is a routine system operation (driver unbind or `stm-drm` module reload during an update), not an additional privilege the attacker must hold; they merely keep the fd open across it.\nUI:N - The attacker opens the fd, sprays the slab, and closes the fd or issues the GET* ioctls entirely on their own; on single-purpose STM32MP appliances the driver reload happens autonomously as part of normal system operation. No victim must be lured into opening a file, mounting media, or plugging in hardware.\nS:U - The corrupted objects and the hijacked control flow are kernel heap and kernel function pointers on the same host, within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - After the devres free, unprivileged `MODE_GETRESOURCES`/`GETCRTC`/`GETPLANE`/`GETCONNECTOR` ioctls read the freed `drm_crtc`/`drm_plane`/`drm_connector` slab objects and copy fields out to userspace, disclosing whatever kernel data now occupies those kmalloc buckets. Combined with a controlled reclaim this yields a general kernel heap read primitive.\nI:H - `drm_mode_config_cleanup()` performs `encoder-\u003efuncs-\u003edestroy()`, `plane-\u003efuncs-\u003edestroy()` and `crtc-\u003efuncs-\u003edestroy()` by loading a function-pointer table out of the freed allocation, and `drm_mode_object_get/put()` does atomic read-modify-write on the freed objects \u2014 giving an attacker who has groomed the slab both an arbitrary-write and a direct control-flow-hijack primitive leading to kernel code execution.\nA:H - Even unexploited, walking `mode_config`\u0027s crtc/plane/encoder/connector lists through freed memory and calling through a stale `funcs` pointer reliably oopses or panics the kernel, and the display teardown path is unrecoverable. The condition is reproducible on every unbind-with-open-fd cycle."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:57.945Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d02611ff001454358be6910cb926799e2d818716"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a1741d10da29aa84955ef89ae9a03c4b6038657"
        },
        {
          "url": "https://git.kernel.org/stable/c/454e5d7e671946698af0f201e48469e5ddb42851"
        },
        {
          "url": "https://git.kernel.org/stable/c/b22eec4b57d04befa90e8554ede34e6c67257606"
        },
        {
          "url": "https://git.kernel.org/stable/c/19dd9780b7ac673be95bf6fd6892a184c9db611f"
        }
      ],
      "title": "drm/stm: Avoid use-after-free issues with crtc and plane",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49992",
    "datePublished": "2024-10-21T18:02:34.442Z",
    "dateReserved": "2024-10-21T12:17:06.054Z",
    "dateUpdated": "2026-08-05T11:40:57.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49992",
      "date": "2026-08-06",
      "epss": "0.00238",
      "percentile": "0.14899"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"180292D6-C3A4-4883-98A3-77F4D56F8081\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.55\", \"matchCriteriaId\": \"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.14\", \"matchCriteriaId\": \"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.3\", \"matchCriteriaId\": \"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/stm: Avoid use-after-free issues with crtc and plane\\n\\nltdc_load() calls functions drm_crtc_init_with_planes(),\\ndrm_universal_plane_init() and drm_encoder_init(). These functions\\nshould not be called with parameters allocated with devm_kzalloc()\\nto avoid use-after-free issues [1].\\n\\nUse allocations managed by the DRM framework.\\n\\nFound by Linux Verification Center (linuxtesting.org).\\n\\n[1]\\nhttps://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/stm: Evite problemas de use after free con crtc y plane ltdc_load() llama a las funciones drm_crtc_init_with_planes(), drm_universal_plane_init() y drm_encoder_init(). Estas funciones no deben llamarse con par\\u00e1metros asignados con devm_kzalloc() para evitar problemas de use after free [1]. Use asignaciones administradas por el framework DRM. Encontrado por Linux Verification Center (linuxtesting.org). [1] https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/\"}]",
      "id": "CVE-2024-49992",
      "lastModified": "2024-10-25T14:52:00.273",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-10-21T18:15:19.387",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0a1741d10da29aa84955ef89ae9a03c4b6038657\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/19dd9780b7ac673be95bf6fd6892a184c9db611f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/454e5d7e671946698af0f201e48469e5ddb42851\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b22eec4b57d04befa90e8554ede34e6c67257606\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d02611ff001454358be6910cb926799e2d818716\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49992\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:19.387\",\"lastModified\":\"2026-08-04T11:21:07.043\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/stm: Avoid use-after-free issues with crtc and plane\\n\\nltdc_load() calls functions drm_crtc_init_with_planes(),\\ndrm_universal_plane_init() and drm_encoder_init(). These functions\\nshould not be called with parameters allocated with devm_kzalloc()\\nto avoid use-after-free issues [1].\\n\\nUse allocations managed by the DRM framework.\\n\\nFound by Linux Verification Center (linuxtesting.org).\\n\\n[1]\\nhttps://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/stm: Evite problemas de use after free con crtc y plane ltdc_load() llama a las funciones drm_crtc_init_with_planes(), drm_universal_plane_init() y drm_encoder_init(). Estas funciones no deben llamarse con par\u00e1metros asignados con devm_kzalloc() para evitar problemas de use after free [1]. Use asignaciones administradas por el framework DRM. Encontrado por Linux Verification Center (linuxtesting.org). [1] https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/stm/drv.c\",\"drivers/gpu/drm/stm/ltdc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b759012c5fa761ee08998c80fc4ad6343c258487\",\"lessThan\":\"d02611ff001454358be6910cb926799e2d818716\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b759012c5fa761ee08998c80fc4ad6343c258487\",\"lessThan\":\"0a1741d10da29aa84955ef89ae9a03c4b6038657\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b759012c5fa761ee08998c80fc4ad6343c258487\",\"lessThan\":\"454e5d7e671946698af0f201e48469e5ddb42851\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b759012c5fa761ee08998c80fc4ad6343c258487\",\"lessThan\":\"b22eec4b57d04befa90e8554ede34e6c67257606\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b759012c5fa761ee08998c80fc4ad6343c258487\",\"lessThan\":\"19dd9780b7ac673be95bf6fd6892a184c9db611f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/stm/drv.c\",\"drivers/gpu/drm/stm/ltdc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.55\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.14\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.3\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:31:07.009365Z\",\"id\":\"CVE-2024-49992\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"180292D6-C3A4-4883-98A3-77F4D56F8081\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.55\",\"matchCriteriaId\":\"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a1741d10da29aa84955ef89ae9a03c4b6038657\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/19dd9780b7ac673be95bf6fd6892a184c9db611f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/454e5d7e671946698af0f201e48469e5ddb42851\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b22eec4b57d04befa90e8554ede34e6c67257606\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d02611ff001454358be6910cb926799e2d818716\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:48:09+00:00",
      "cve": "CVE-2024-49992",
      "id": "CVE-2024-49992",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/stm: Avoid use-after-free issues with crtc and plane",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49992.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-23T01:57:22Z",
      "cve": "CVE-2024-49992",
      "id": "CVE-2024-49992",
      "initial_release_date": "2024-10-29T04:16:23Z",
      "product_status:known_not_affected": "402",
      "product_status:recommended": "65",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49992",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49992.json",
      "version": "25"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:24:11.293Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49992\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:31:07.009365Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:31:10.231Z\"}}], \"cna\": {\"title\": \"drm/stm: Avoid use-after-free issues with crtc and plane\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b759012c5fa761ee08998c80fc4ad6343c258487\", \"lessThan\": \"d02611ff001454358be6910cb926799e2d818716\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b759012c5fa761ee08998c80fc4ad6343c258487\", \"lessThan\": \"0a1741d10da29aa84955ef89ae9a03c4b6038657\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b759012c5fa761ee08998c80fc4ad6343c258487\", \"lessThan\": \"454e5d7e671946698af0f201e48469e5ddb42851\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b759012c5fa761ee08998c80fc4ad6343c258487\", \"lessThan\": \"b22eec4b57d04befa90e8554ede34e6c67257606\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b759012c5fa761ee08998c80fc4ad6343c258487\", \"lessThan\": \"19dd9780b7ac673be95bf6fd6892a184c9db611f\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/stm/drv.c\", \"drivers/gpu/drm/stm/ltdc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/stm/drv.c\", \"drivers/gpu/drm/stm/ltdc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d02611ff001454358be6910cb926799e2d818716\"}, {\"url\": \"https://git.kernel.org/stable/c/0a1741d10da29aa84955ef89ae9a03c4b6038657\"}, {\"url\": \"https://git.kernel.org/stable/c/454e5d7e671946698af0f201e48469e5ddb42851\"}, {\"url\": \"https://git.kernel.org/stable/c/b22eec4b57d04befa90e8554ede34e6c67257606\"}, {\"url\": \"https://git.kernel.org/stable/c/19dd9780b7ac673be95bf6fd6892a184c9db611f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/stm: Avoid use-after-free issues with crtc and plane\\n\\nltdc_load() calls functions drm_crtc_init_with_planes(),\\ndrm_universal_plane_init() and drm_encoder_init(). These functions\\nshould not be called with parameters allocated with devm_kzalloc()\\nto avoid use-after-free issues [1].\\n\\nUse allocations managed by the DRM framework.\\n\\nFound by Linux Verification Center (linuxtesting.org).\\n\\n[1]\\nhttps://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.55\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"4.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:43:29.079Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49992\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:43:29.079Z\", \"dateReserved\": \"2024-10-21T12:17:06.054Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:02:34.442Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.