CVE-2024-42259

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-42259", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-30T07:40:12.257Z", "datePublished": "2024-08-14T14:50:49.844Z", "dateUpdated": "2026-10-15T00:48:06.819Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:08.919Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Fix Virtual Memory mapping boundaries calculation\n\nCalculating the size of the mapped area as the lesser value\nbetween the requested size and the actual size does not consider\nthe partial mapping offset. This can cause page fault access.\n\nFix the calculation of the starting and ending addresses, the\ntotal size is now deduced from the difference between the end and\nstart addresses.\n\nAdditionally, the calculations have been rewritten in a clearer\nand more understandable form.\n\n[Joonas: Add Requires: tag]\nRequires: 60a2066c5005 (\"drm/i915/gem: Adjust vma offset for framebuffer mmap offset\")\n(cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local access to the i915 DRM device node (`/dev/dri/renderD128` or `card0`) to issue GEM_CREATE/GEM_MMAP_OFFSET ioctls, mmap the returned fake offset, and take a page fault. There is no network-reachable path to `vm_fault_gtt()`.\nAC:L - The attacker fully controls every input: object size (larger than the mappable aperture, deterministically forcing the partial-view path), mmap length (chosen non-chunk-aligned so `partial.offset + min(vma->size, vma_len) > vma_len`), and the faulting address. No race, no dependence on uncontrolled memory layout.\nPR:L - Both `I915_GEM_CREATE` and `I915_GEM_MMAP_OFFSET` are `DRM_RENDER_ALLOW`, so an ordinary unprivileged user with render-node access \u2014 the logged-in desktop user, a member of the `render`/`video` group, or any container with `/dev/dri` passed through \u2014 can reach the code. No root or capability is needed.\nUI:N - The attacking process performs the ioctl, mmap and memory access entirely on its own; no victim action or interaction is involved.\nS:U - The corruption occurs in kernel-managed page tables and the GPU aperture within the same kernel security authority; this is standard local kernel compromise rather than a VM or IOMMU boundary crossing.\nC:H - Up to ~1 MB of aperture PTEs are installed outside the VMA and are never zapped by i915's revocation path (`unmap_mapping_range` clamps to the VMA), so after the GGTT window is reused the attacker keeps a live read window onto arbitrary physical pages \u2014 other processes' GEM buffers, framebuffers, ring buffers and GPU page tables.\nI:H - The same out-of-bounds PTEs are writable write-combining mappings, giving an out-of-bounds write over neighbouring VMAs' page tables and, via the unrevoked stale aperture mapping, write access to GGTT/PPGTT page-table objects \u2014 which converts into arbitrary DMA and kernel code execution.\nA:H - Page tables are populated for addresses covered by no VMA (and PTEs are overwritten in unrelated VMAs), producing the \"page fault access\" cited in the fix, pgtable accounting mismatches and oopses/panics; the attacker can trigger this repeatedly at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_mman.c"], "versions": [{"version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "3e06073d24807f04b4694108a8474decb7b99e60", "status": "affected", "versionType": "git"}, {"version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "a256d019eaf044864c7e50312f0a65b323c24f39", "status": "affected", "versionType": "git"}, {"version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "50111a8098fb9ade621eeff82228a997d42732ab", "status": "affected", "versionType": "git"}, {"version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "911f8055f175c82775d0fd8cedcd0b75413f4ba7", "status": "affected", "versionType": "git"}, {"version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b", "status": "affected", "versionType": "git"}, {"version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "4b09513ce93b3dcb590baaaff2ce96f2d098312d", "status": "affected", "versionType": "git"}, {"version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "ead9289a51ea82eb5b27029fcf4c34b2dd60cf06", "status": "affected", "versionType": "git"}, {"version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_mman.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.320", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.282", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.224", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.165", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.106", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.46", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.5", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "4.19.320"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.4.282"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.106"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.10.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3e06073d24807f04b4694108a8474decb7b99e60"}, {"url": "https://git.kernel.org/stable/c/a256d019eaf044864c7e50312f0a65b323c24f39"}, {"url": "https://git.kernel.org/stable/c/50111a8098fb9ade621eeff82228a997d42732ab"}, {"url": "https://git.kernel.org/stable/c/911f8055f175c82775d0fd8cedcd0b75413f4ba7"}, {"url": "https://git.kernel.org/stable/c/e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b"}, {"url": "https://git.kernel.org/stable/c/4b09513ce93b3dcb590baaaff2ce96f2d098312d"}, {"url": "https://git.kernel.org/stable/c/ead9289a51ea82eb5b27029fcf4c34b2dd60cf06"}, {"url": "https://git.kernel.org/stable/c/8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3"}, {"url": "https://project-zero.issues.chromium.org/issues/42451707"}], "title": "drm/i915/gem: Fix Virtual Memory mapping boundaries calculation", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42259", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:12:50.301256Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:33.719Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:02:56.873Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:48:06.819Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:02:56.873Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:48:06.819Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42259", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:12:50.301256Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:23.996Z"}}], "cna": {"title": "drm/i915/gem: Fix Virtual Memory mapping boundaries calculation", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local access to the i915 DRM device node (`/dev/dri/renderD128` or `card0`) to issue GEM_CREATE/GEM_MMAP_OFFSET ioctls, mmap the returned fake offset, and take a page fault. There is no network-reachable path to `vm_fault_gtt()`.\nAC:L - The attacker fully controls every input: object size (larger than the mappable aperture, deterministically forcing the partial-view path), mmap length (chosen non-chunk-aligned so `partial.offset + min(vma->size, vma_len) > vma_len`), and the faulting address. No race, no dependence on uncontrolled memory layout.\nPR:L - Both `I915_GEM_CREATE` and `I915_GEM_MMAP_OFFSET` are `DRM_RENDER_ALLOW`, so an ordinary unprivileged user with render-node access \u2014 the logged-in desktop user, a member of the `render`/`video` group, or any container with `/dev/dri` passed through \u2014 can reach the code. No root or capability is needed.\nUI:N - The attacking process performs the ioctl, mmap and memory access entirely on its own; no victim action or interaction is involved.\nS:U - The corruption occurs in kernel-managed page tables and the GPU aperture within the same kernel security authority; this is standard local kernel compromise rather than a VM or IOMMU boundary crossing.\nC:H - Up to ~1 MB of aperture PTEs are installed outside the VMA and are never zapped by i915's revocation path (`unmap_mapping_range` clamps to the VMA), so after the GGTT window is reused the attacker keeps a live read window onto arbitrary physical pages \u2014 other processes' GEM buffers, framebuffers, ring buffers and GPU page tables.\nI:H - The same out-of-bounds PTEs are writable write-combining mappings, giving an out-of-bounds write over neighbouring VMAs' page tables and, via the unrevoked stale aperture mapping, write access to GGTT/PPGTT page-table objects \u2014 which converts into arbitrary DMA and kernel code execution.\nA:H - Page tables are populated for addresses covered by no VMA (and PTEs are overwritten in unrelated VMAs), producing the \"page fault access\" cited in the fix, pgtable accounting mismatches and oopses/panics; the attacker can trigger this repeatedly at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "3e06073d24807f04b4694108a8474decb7b99e60", "versionType": "git"}, {"status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "a256d019eaf044864c7e50312f0a65b323c24f39", "versionType": "git"}, {"status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "50111a8098fb9ade621eeff82228a997d42732ab", "versionType": "git"}, {"status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "911f8055f175c82775d0fd8cedcd0b75413f4ba7", "versionType": "git"}, {"status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b", "versionType": "git"}, {"status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "4b09513ce93b3dcb590baaaff2ce96f2d098312d", "versionType": "git"}, {"status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "ead9289a51ea82eb5b27029fcf4c34b2dd60cf06", "versionType": "git"}, {"status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "lessThan": "8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_mman.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"status": "unaffected", "version": "0", "lessThan": "4.9", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.320", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.282", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.224", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.165", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.106", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.46", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.5", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_mman.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3e06073d24807f04b4694108a8474decb7b99e60"}, {"url": "https://git.kernel.org/stable/c/a256d019eaf044864c7e50312f0a65b323c24f39"}, {"url": "https://git.kernel.org/stable/c/50111a8098fb9ade621eeff82228a997d42732ab"}, {"url": "https://git.kernel.org/stable/c/911f8055f175c82775d0fd8cedcd0b75413f4ba7"}, {"url": "https://git.kernel.org/stable/c/e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b"}, {"url": "https://git.kernel.org/stable/c/4b09513ce93b3dcb590baaaff2ce96f2d098312d"}, {"url": "https://git.kernel.org/stable/c/ead9289a51ea82eb5b27029fcf4c34b2dd60cf06"}, {"url": "https://git.kernel.org/stable/c/8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3"}, {"url": "https://project-zero.issues.chromium.org/issues/42451707"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Fix Virtual Memory mapping boundaries calculation\n\nCalculating the size of the mapped area as the lesser value\nbetween the requested size and the actual size does not consider\nthe partial mapping offset. This can cause page fault access.\n\nFix the calculation of the starting and ending addresses, the\ntotal size is now deduced from the difference between the end and\nstart addresses.\n\nAdditionally, the calculations have been rewritten in a clearer\nand more understandable form.\n\n[Joonas: Add Requires: tag]\nRequires: 60a2066c5005 (\"drm/i915/gem: Adjust vma offset for framebuffer mmap offset\")\n(cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.320", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.282", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.224", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.165", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.106", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.46", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.5", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "4.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:08.919Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42259", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:48:06.819Z", "dateReserved": "2024-07-30T07:40:12.257Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-14T14:50:49.844Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_mman.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3e06073d24807f04b4694108a8474decb7b99e60", "status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "versionType": "git"}, {"lessThan": "a256d019eaf044864c7e50312f0a65b323c24f39", "status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "versionType": "git"}, {"lessThan": "50111a8098fb9ade621eeff82228a997d42732ab", "status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "versionType": "git"}, {"lessThan": "911f8055f175c82775d0fd8cedcd0b75413f4ba7", "status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "versionType": "git"}, {"lessThan": "e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b", "status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "versionType": "git"}, {"lessThan": "4b09513ce93b3dcb590baaaff2ce96f2d098312d", "status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "versionType": "git"}, {"lessThan": "ead9289a51ea82eb5b27029fcf4c34b2dd60cf06", "status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "versionType": "git"}, {"lessThan": "8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3", "status": "affected", "version": "c58305af1835095ddc25ee6f548ac05915e66ac5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_mman.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.106", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.46", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F30738D4-FF99-4B8F-A798-76B5C6F59C79", "versionEndExcluding": "4.19.320", "versionStartIncluding": "4.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A8961D98-9ACF-4188-BA88-44038B14BC28", "versionEndExcluding": "5.4.282", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5CCEDF13-293D-4E64-B501-4409D0365AFE", "versionEndExcluding": "5.10.224", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4E2B568-3171-41DE-B519-F2B1A3600D94", "versionEndExcluding": "5.15.165", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3F3AF3DA-1553-4AB8-97CC-7D0C91E4E23F", "versionEndExcluding": "6.1.106", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA11941E-81FB-484C-B583-881EEB488340", "versionEndExcluding": "6.6.46", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D074AE50-4A5E-499C-A2FD-75FD60DEA560", "versionEndExcluding": "6.10.5", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Fix Virtual Memory mapping boundaries calculation\n\nCalculating the size of the mapped area as the lesser value\nbetween the requested size and the actual size does not consider\nthe partial mapping offset. This can cause page fault access.\n\nFix the calculation of the starting and ending addresses, the\ntotal size is now deduced from the difference between the end and\nstart addresses.\n\nAdditionally, the calculations have been rewritten in a clearer\nand more understandable form.\n\n[Joonas: Add Requires: tag]\nRequires: 60a2066c5005 (\"drm/i915/gem: Adjust vma offset for framebuffer mmap offset\")\n(cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417)"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/i915/gem: Arreglar el c\u00e1lculo de los l\u00edmites del mapeo de la memoria virtual. El c\u00e1lculo del tama\u00f1o del \u00e1rea mapeada como el valor menor entre el tama\u00f1o solicitado y el tama\u00f1o real no considera el desplazamiento del mapeo parcial. . Esto puede provocar un error de acceso a la p\u00e1gina. Corrija el c\u00e1lculo de las direcciones inicial y final; el tama\u00f1o total ahora se deduce de la diferencia entre las direcciones final e inicial. Adem\u00e1s, los c\u00e1lculos se han reescrito de una forma m\u00e1s clara y comprensible. [Joonas: Add Requires: tag] Requiere: 60a2066c5005 (\"drm/i915/gem: Ajustar el desplazamiento de vma para el desplazamiento de mmap del framebuffer\") (seleccionado de la confirmaci\u00f3n 97b6784753da06d9d40232328efc5c5367e53417)"}], "id": "CVE-2024-42259", "lastModified": "2026-10-15T01:18:44.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42259", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:12:50.301256Z", "version": "2.0.3"}}]}, "published": "2024-08-14T15:15:31.673", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3e06073d24807f04b4694108a8474decb7b99e60"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4b09513ce93b3dcb590baaaff2ce96f2d098312d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/50111a8098fb9ade621eeff82228a997d42732ab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/911f8055f175c82775d0fd8cedcd0b75413f4ba7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a256d019eaf044864c7e50312f0a65b323c24f39"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ead9289a51ea82eb5b27029fcf4c34b2dd60cf06"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://project-zero.issues.chromium.org/issues/42451707"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-131"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation", "id": "2304965", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304965"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-119", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/i915/gem: Fix Virtual Memory mapping boundaries calculation\nCalculating the size of the mapped area as the lesser value\nbetween the requested size and the actual size does not consider\nthe partial mapping offset. This can cause page fault access.\nFix the calculation of the starting and ending addresses, the\ntotal size is now deduced from the difference between the end and\nstart addresses.\nAdditionally, the calculations have been rewritten in a clearer\nand more understandable form.\n[Joonas: Add Requires: tag]\nRequires: 60a2066c5005 (\"drm/i915/gem: Adjust vma offset for framebuffer mmap offset\")\n(cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417)"], "name": "CVE-2024-42259", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-42259\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-42259\nhttps://lore.kernel.org/linux-cve-announce/2024081452-CVE-2024-42259-4cef@gregkh/T"], "threat_severity": "Moderate"}

{}