CVE-2024-46710

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-46710", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.252Z", "datePublished": "2024-09-13T06:33:42.285Z", "dateUpdated": "2026-08-05T11:38:05.250Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:05.250Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Prevent unmapping active read buffers\n\nThe kms paths keep a persistent map active to read and compare the cursor\nbuffer. These maps can race with each other in simple scenario where:\na) buffer \"a\" mapped for update\nb) buffer \"a\" mapped for compare\nc) do the compare\nd) unmap \"a\" for compare\ne) update the cursor\nf) unmap \"a\" for update\nAt step \"e\" the buffer has been unmapped and the read contents is bogus.\n\nPrevent unmapping of active read buffers by simply keeping a count of\nhow many paths have currently active maps and unmap only when the count\nreaches 0."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The only route to the racing map/unmap pairs is the DRM cursor/atomic-commit ioctl path on /dev/dri/card* (`drm_mode_cursor_ioctl`, `drm_mode_atomic_ioctl`) plus the vmwgfx VKMS CRC worker, all of which require a local open of the GPU device node. No network, adjacent-network, or physical-bus data reaches this code.\nAC:L - The attacker controls both sides of the race \u2014 vmwgfx exposes 8 cursor planes, so the same GEM-backed cursor framebuffer can be bound to several planes and hammered from concurrent threads, with `prepare_fb` mapping while another CRTC's `cleanup_fb`/`vmw_user_object_unmap` tears the shared cached map down. The window can be retried without limit and no attacker-uncontrollable precondition exists.\nPR:L - The ioctls are gated only on DRM master, not on any capability; a locally logged-in user receives the card node via logind ACL (or `video` group) and becomes master on open when no compositor holds it, which is the normal case on a headless or console-only VMware guest. Real root in the initial namespace is not needed.\nUI:N - The attacker performs every step itself \u2014 allocating the dumb buffer, binding it as a cursor framebuffer, and issuing the concurrent cursor/atomic commits. No victim action or cooperating process is required.\nS:U - The corrupted vmalloc range and the leaked data both belong to the same guest kernel that hosts the vulnerable driver, so the impact stays within one security authority. Being a paravirtual guest driver does not let this cross into the hypervisor.\nC:H - After `vunmap()` the cached virtual address can be reused by any other vmalloc allocation, and the read paths (`memcmp` in `vmw_du_cursor_plane_has_changed`, the 16 KB `memcpy` source in `vmw_cursor_update_mob`, and `crc32_le` in `compute_crc`) then pull that reclaimed kernel memory into the displayed cursor image or a userspace-visible CRC. This is a stale-mapping read of effectively arbitrary kernel memory, not a bounded leak.\nI:H - `vmw_cursor_update_mob()` performs `memset(header, 0, ...)` and a 16 KB `memcpy` of fully attacker-controlled dumb-buffer pixel data through the stale mapping, writing chosen bytes into whatever vmalloc allocation reclaimed that address range. With CONFIG_VMAP_STACK the same 16 KB granularity is used for kernel thread stacks, giving a realistic path to control-flow hijack.\nA:H - If the purged vmap area has not been reused, the subsequent read or write dereferences unmapped kernel virtual addresses, producing an immediate kernel page fault/oops; if it has been reused, the 16 KB overwrite corrupts unrelated kernel state and panics the system. Either outcome is a full crash, and it is repeatable on demand."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_bo.c", "drivers/gpu/drm/vmwgfx/vmwgfx_bo.h"], "versions": [{"version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "lessThan": "58a3714db4d9dcaeb9fc4905141e17b9f536c0a5", "status": "affected", "versionType": "git"}, {"version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "lessThan": "0851b1ec650adadcaa23ec96daad95a55bf966f0", "status": "affected", "versionType": "git"}, {"version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "lessThan": "d5228d158e4c0b1663b3983044913c15c3d0135e", "status": "affected", "versionType": "git"}, {"version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "lessThan": "aba07b9a0587f50e5d3346eaa19019cf3f86c0ea", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_bo.c", "drivers/gpu/drm/vmwgfx/vmwgfx_bo.h"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.54", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.8", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.10.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/58a3714db4d9dcaeb9fc4905141e17b9f536c0a5"}, {"url": "https://git.kernel.org/stable/c/0851b1ec650adadcaa23ec96daad95a55bf966f0"}, {"url": "https://git.kernel.org/stable/c/d5228d158e4c0b1663b3983044913c15c3d0135e"}, {"url": "https://git.kernel.org/stable/c/aba07b9a0587f50e5d3346eaa19019cf3f86c0ea"}], "title": "drm/vmwgfx: Prevent unmapping active read buffers", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-29T14:59:47.963109Z", "id": "CVE-2024-46710", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T15:00:04.356Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:16:37.924Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:16:37.924Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-46710", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-29T14:59:47.963109Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T14:59:52.072Z"}}], "cna": {"title": "drm/vmwgfx: Prevent unmapping active read buffers", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The only route to the racing map/unmap pairs is the DRM cursor/atomic-commit ioctl path on /dev/dri/card* (`drm_mode_cursor_ioctl`, `drm_mode_atomic_ioctl`) plus the vmwgfx VKMS CRC worker, all of which require a local open of the GPU device node. No network, adjacent-network, or physical-bus data reaches this code.\nAC:L - The attacker controls both sides of the race \u2014 vmwgfx exposes 8 cursor planes, so the same GEM-backed cursor framebuffer can be bound to several planes and hammered from concurrent threads, with `prepare_fb` mapping while another CRTC's `cleanup_fb`/`vmw_user_object_unmap` tears the shared cached map down. The window can be retried without limit and no attacker-uncontrollable precondition exists.\nPR:L - The ioctls are gated only on DRM master, not on any capability; a locally logged-in user receives the card node via logind ACL (or `video` group) and becomes master on open when no compositor holds it, which is the normal case on a headless or console-only VMware guest. Real root in the initial namespace is not needed.\nUI:N - The attacker performs every step itself \u2014 allocating the dumb buffer, binding it as a cursor framebuffer, and issuing the concurrent cursor/atomic commits. No victim action or cooperating process is required.\nS:U - The corrupted vmalloc range and the leaked data both belong to the same guest kernel that hosts the vulnerable driver, so the impact stays within one security authority. Being a paravirtual guest driver does not let this cross into the hypervisor.\nC:H - After `vunmap()` the cached virtual address can be reused by any other vmalloc allocation, and the read paths (`memcmp` in `vmw_du_cursor_plane_has_changed`, the 16 KB `memcpy` source in `vmw_cursor_update_mob`, and `crc32_le` in `compute_crc`) then pull that reclaimed kernel memory into the displayed cursor image or a userspace-visible CRC. This is a stale-mapping read of effectively arbitrary kernel memory, not a bounded leak.\nI:H - `vmw_cursor_update_mob()` performs `memset(header, 0, ...)` and a 16 KB `memcpy` of fully attacker-controlled dumb-buffer pixel data through the stale mapping, writing chosen bytes into whatever vmalloc allocation reclaimed that address range. With CONFIG_VMAP_STACK the same 16 KB granularity is used for kernel thread stacks, giving a realistic path to control-flow hijack.\nA:H - If the purged vmap area has not been reused, the subsequent read or write dereferences unmapped kernel virtual addresses, producing an immediate kernel page fault/oops; if it has been reused, the 16 KB overwrite corrupts unrelated kernel state and panics the system. Either outcome is a full crash, and it is repeatable on demand."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "lessThan": "58a3714db4d9dcaeb9fc4905141e17b9f536c0a5", "versionType": "git"}, {"status": "affected", "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "lessThan": "0851b1ec650adadcaa23ec96daad95a55bf966f0", "versionType": "git"}, {"status": "affected", "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "lessThan": "d5228d158e4c0b1663b3983044913c15c3d0135e", "versionType": "git"}, {"status": "affected", "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "lessThan": "aba07b9a0587f50e5d3346eaa19019cf3f86c0ea", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_bo.c", "drivers/gpu/drm/vmwgfx/vmwgfx_bo.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"status": "unaffected", "version": "0", "lessThan": "5.19", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.113", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.54", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.8", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_bo.c", "drivers/gpu/drm/vmwgfx/vmwgfx_bo.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/58a3714db4d9dcaeb9fc4905141e17b9f536c0a5"}, {"url": "https://git.kernel.org/stable/c/0851b1ec650adadcaa23ec96daad95a55bf966f0"}, {"url": "https://git.kernel.org/stable/c/d5228d158e4c0b1663b3983044913c15c3d0135e"}, {"url": "https://git.kernel.org/stable/c/aba07b9a0587f50e5d3346eaa19019cf3f86c0ea"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Prevent unmapping active read buffers\n\nThe kms paths keep a persistent map active to read and compare the cursor\nbuffer. These maps can race with each other in simple scenario where:\na) buffer \"a\" mapped for update\nb) buffer \"a\" mapped for compare\nc) do the compare\nd) unmap \"a\" for compare\ne) update the cursor\nf) unmap \"a\" for update\nAt step \"e\" the buffer has been unmapped and the read contents is bogus.\n\nPrevent unmapping of active read buffers by simply keeping a count of\nhow many paths have currently active maps and unmap only when the count\nreaches 0."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.113", "versionStartIncluding": "5.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.54", "versionStartIncluding": "5.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.8", "versionStartIncluding": "5.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "5.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:05.250Z"}}}, "cveMetadata": {"cveId": "CVE-2024-46710", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:38:05.250Z", "dateReserved": "2024-09-11T15:12:18.252Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-09-13T06:33:42.285Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_bo.c", "drivers/gpu/drm/vmwgfx/vmwgfx_bo.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "58a3714db4d9dcaeb9fc4905141e17b9f536c0a5", "status": "affected", "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "versionType": "git"}, {"lessThan": "0851b1ec650adadcaa23ec96daad95a55bf966f0", "status": "affected", "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "versionType": "git"}, {"lessThan": "d5228d158e4c0b1663b3983044913c15c3d0135e", "status": "affected", "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "versionType": "git"}, {"lessThan": "aba07b9a0587f50e5d3346eaa19019cf3f86c0ea", "status": "affected", "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_bo.c", "drivers/gpu/drm/vmwgfx/vmwgfx_bo.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.113", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.54", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DA05BB16-4465-46ED-A5AB-5CDE73240EA3", "versionEndExcluding": "6.10.8", "versionStartIncluding": "5.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*", "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*", "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*", "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*", "matchCriteriaId": "39889A68-6D34-47A6-82FC-CD0BF23D6754", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*", "matchCriteriaId": "B8383ABF-1457-401F-9B61-EE50F4C61F4F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Prevent unmapping active read buffers\n\nThe kms paths keep a persistent map active to read and compare the cursor\nbuffer. These maps can race with each other in simple scenario where:\na) buffer \"a\" mapped for update\nb) buffer \"a\" mapped for compare\nc) do the compare\nd) unmap \"a\" for compare\ne) update the cursor\nf) unmap \"a\" for update\nAt step \"e\" the buffer has been unmapped and the read contents is bogus.\n\nPrevent unmapping of active read buffers by simply keeping a count of\nhow many paths have currently active maps and unmap only when the count\nreaches 0."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/vmwgfx: evitar la desasignaci\u00f3n de b\u00faferes de lectura activos Las rutas kms mantienen activo un mapa persistente para leer y comparar el b\u00fafer del cursor. Estos mapas pueden competir entre s\u00ed en un escenario simple donde: a) b\u00fafer \"a\" mapeado para actualizaci\u00f3n b) b\u00fafer \"a\" mapeado para comparaci\u00f3n c) hacer la comparaci\u00f3n d) desasignar \"a\" para comparaci\u00f3n e) actualizar el cursor f) desasignar \"a\" para actualizaci\u00f3n En el paso \"e\", el b\u00fafer ha sido desasignado y el contenido de lectura es falso. Evite la desasignaci\u00f3n de b\u00faferes de lectura activos simplemente llevando un recuento de cu\u00e1ntas rutas tienen mapas activos actualmente y desasign\u00e1ndolos solo cuando el recuento llegue a 0."}], "id": "CVE-2024-46710", "lastModified": "2026-08-04T11:20:17.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-46710", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-29T14:59:47.963109Z", "version": "2.0.3"}}]}, "published": "2024-09-13T07:15:05.880", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0851b1ec650adadcaa23ec96daad95a55bf966f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/58a3714db4d9dcaeb9fc4905141e17b9f536c0a5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aba07b9a0587f50e5d3346eaa19019cf3f86c0ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d5228d158e4c0b1663b3983044913c15c3d0135e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/vmwgfx: Prevent unmapping active read buffers", "id": "2312107", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2312107"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-362", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/vmwgfx: Prevent unmapping active read buffers\nThe kms paths keep a persistent map active to read and compare the cursor\nbuffer. These maps can race with each other in simple scenario where:\na) buffer \"a\" mapped for update\nb) buffer \"a\" mapped for compare\nc) do the compare\nd) unmap \"a\" for compare\ne) update the cursor\nf) unmap \"a\" for update\nAt step \"e\" the buffer has been unmapped and the read contents is bogus.\nPrevent unmapping of active read buffers by simply keeping a count of\nhow many paths have currently active maps and unmap only when the count\nreaches 0."], "name": "CVE-2024-46710", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-09-13T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-46710\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-46710\nhttps://lore.kernel.org/linux-cve-announce/2024091347-CVE-2024-46710-cd88@gregkh/T"], "threat_severity": "Low"}

{}