CVE-2024-58091 (GCVE-0-2024-58091)
Vulnerability from cvelistv5
Published
2025-03-27 14:57
Modified
2025-07-06 09:08
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Add shadow buffering for deferred I/O DMA areas are not necessarily backed by struct page, so we cannot rely on it for deferred I/O. Allocate a shadow buffer for drivers that require deferred I/O and use it as framebuffer memory. Fixes driver errors about being "Unable to handle kernel NULL pointer dereference at virtual address" or "Unable to handle kernel paging request at virtual address". The patch splits drm_fbdev_dma_driver_fbdev_probe() in an initial allocation, which creates the DMA-backed buffer object, and a tail that sets up the fbdev data structures. There is a tail function for direct memory mappings and a tail function for deferred I/O with the shadow buffer. It is no longer possible to use deferred I/O without shadow buffer. It can be re-added if there exists a reliably test for usable struct page in the allocated DMA-backed buffer object.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0d087de947babf7ed70029d042abcc6ed06ff415
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3603996432997f7c88da37a97062a46cda01ac9d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cdc581169942de3b9e2648cfbd98c5ff9111c2c8
Impacted products
Vendor Product Version
Linux Linux Version: 5ab91447aa13b8b98bc11f5326f33500b0ee2c48
Version: 5ab91447aa13b8b98bc11f5326f33500b0ee2c48
Version: 5ab91447aa13b8b98bc11f5326f33500b0ee2c48
 Create a notification for this product.
   Linux Linux Version: 6.11
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_fbdev_dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d087de947babf7ed70029d042abcc6ed06ff415",
              "status": "affected",
              "version": "5ab91447aa13b8b98bc11f5326f33500b0ee2c48",
              "versionType": "git"
            },
            {
              "lessThan": "cdc581169942de3b9e2648cfbd98c5ff9111c2c8",
              "status": "affected",
              "version": "5ab91447aa13b8b98bc11f5326f33500b0ee2c48",
              "versionType": "git"
            },
            {
              "lessThan": "3603996432997f7c88da37a97062a46cda01ac9d",
              "status": "affected",
              "version": "5ab91447aa13b8b98bc11f5326f33500b0ee2c48",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_fbdev_dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.36",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/fbdev-dma: Add shadow buffering for deferred I/O\n\nDMA areas are not necessarily backed by struct page, so we cannot\nrely on it for deferred I/O. Allocate a shadow buffer for drivers\nthat require deferred I/O and use it as framebuffer memory.\n\nFixes driver errors about being \"Unable to handle kernel NULL pointer\ndereference at virtual address\" or \"Unable to handle kernel paging\nrequest at virtual address\".\n\nThe patch splits drm_fbdev_dma_driver_fbdev_probe() in an initial\nallocation, which creates the DMA-backed buffer object, and a tail\nthat sets up the fbdev data structures. There is a tail function for\ndirect memory mappings and a tail function for deferred I/O with\nthe shadow buffer.\n\nIt is no longer possible to use deferred I/O without shadow buffer.\nIt can be re-added if there exists a reliably test for usable struct\npage in the allocated DMA-backed buffer object."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-06T09:08:48.847Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d087de947babf7ed70029d042abcc6ed06ff415"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdc581169942de3b9e2648cfbd98c5ff9111c2c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3603996432997f7c88da37a97062a46cda01ac9d"
        }
      ],
      "title": "drm/fbdev-dma: Add shadow buffering for deferred I/O",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58091",
    "datePublished": "2025-03-27T14:57:03.560Z",
    "dateReserved": "2025-03-06T15:52:09.188Z",
    "dateUpdated": "2025-07-06T09:08:48.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-58091\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-27T15:15:54.237\",\"lastModified\":\"2025-07-06T10:15:23.140\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/fbdev-dma: Add shadow buffering for deferred I/O\\n\\nDMA areas are not necessarily backed by struct page, so we cannot\\nrely on it for deferred I/O. Allocate a shadow buffer for drivers\\nthat require deferred I/O and use it as framebuffer memory.\\n\\nFixes driver errors about being \\\"Unable to handle kernel NULL pointer\\ndereference at virtual address\\\" or \\\"Unable to handle kernel paging\\nrequest at virtual address\\\".\\n\\nThe patch splits drm_fbdev_dma_driver_fbdev_probe() in an initial\\nallocation, which creates the DMA-backed buffer object, and a tail\\nthat sets up the fbdev data structures. There is a tail function for\\ndirect memory mappings and a tail function for deferred I/O with\\nthe shadow buffer.\\n\\nIt is no longer possible to use deferred I/O without shadow buffer.\\nIt can be re-added if there exists a reliably test for usable struct\\npage in the allocated DMA-backed buffer object.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/fbdev-dma: Se ha a\u00f1adido un b\u00fafer de sombra para E/S diferida. Las \u00e1reas de DMA no est\u00e1n necesariamente respaldadas por struct page, por lo que no podemos confiar en \u00e9l para la E/S diferida. Se asigna un b\u00fafer de sombra a los controladores que requieren E/S diferida y se utiliza como memoria de framebuffer. Se corrigen los errores del controlador \\\"No se puede gestionar la desreferencia de puntero nulo del kernel en la direcci\u00f3n virtual\\\" o \\\"No se puede gestionar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual\\\". El parche divide drm_fbdev_dma_driver_fbdev_probe() en una asignaci\u00f3n inicial, que crea el objeto de b\u00fafer respaldado por DMA, y una cola, que configura las estructuras de datos fbdev. Hay una funci\u00f3n de cola para asignaciones directas de memoria y otra para E/S diferida con el b\u00fafer de sombra. Ya no es posible utilizar la E/S diferida sin el b\u00fafer de sombra. Se puede volver a agregar si existe una prueba confiable de una p\u00e1gina de estructura utilizable en el objeto de b\u00fafer respaldado por DMA asignado.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d087de947babf7ed70029d042abcc6ed06ff415\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3603996432997f7c88da37a97062a46cda01ac9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cdc581169942de3b9e2648cfbd98c5ff9111c2c8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.