In the Linux kernel, the following vulnerability has been resolved:
drm/shmem-helper: Fix BUGON() on mmap(PROTWRITE, MAP_PRIVATE)
Lack of check for copy-on-write (COW) mapping in drmgemshmemmmap allows users to call mmap with PROTWRITE and MAPPRIVATE flag causing a kernel panic due to BUGON in vmfinsertpfnprot: BUGON((vma->vmflags & VMPFNMAP) && iscowmapping(vma->vm_flags));
Return -EINVAL early if COW mapping is detected.
This bug affects all drm drivers using default shmem helpers. It can be reproduced by this simple example: void *ptr = mmap(0, size, PROTWRITE, MAPPRIVATE, fd, mmap_offset); ptr[0] = 0;
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2219e5f97244b79c276751a1167615b9714db1b0",
"deprecated": false,
"digest": {
"line_hashes": [
"276963728232843396731965754333581227009",
"337446261821535460672640934421768649370",
"190801734146327250929004903740879888316"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2024-39497-1c1fafc0",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/drm_gem_shmem_helper.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a508a102edf8735adc9bb73d37dd13c38d1a1b10",
"deprecated": false,
"digest": {
"line_hashes": [
"8258069285893797496234014320296888510",
"174039326317835011996002939752937554687",
"100619543927458230925961395421860174663",
"244811793041375058781714440141170447324",
"213123587954559971137138639152518453698",
"178801120940363507944794752318633059186"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2024-39497-2497f5db",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/drm_gem_shmem_helper.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ae63a8c1685e16958560ec08d30defdc5b9cca0",
"deprecated": false,
"digest": {
"line_hashes": [
"276963728232843396731965754333581227009",
"337446261821535460672640934421768649370",
"190801734146327250929004903740879888316"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2024-39497-29534ce8",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/drm_gem_shmem_helper.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03c71c42809ef4b17f5d874cdb2d3bf40e847b86",
"deprecated": false,
"digest": {
"line_hashes": [
"256981891397702542449644603109832997629",
"239783900347116232115334741218041114709",
"100355034692269131814304642060327042921"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2024-39497-5bf19c7c",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/drm_gem_shmem_helper.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39bc27bd688066a63e56f7f64ad34fae03fbe3b8",
"deprecated": false,
"digest": {
"function_hash": "147973357281029195972584045406323337715",
"length": 625.0
},
"signature_version": "v1",
"id": "CVE-2024-39497-5dec9402",
"signature_type": "Function",
"target": {
"file": "drivers/gpu/drm/drm_gem_shmem_helper.c",
"function": "drm_gem_shmem_mmap"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39bc27bd688066a63e56f7f64ad34fae03fbe3b8",
"deprecated": false,
"digest": {
"line_hashes": [
"256981891397702542449644603109832997629",
"239783900347116232115334741218041114709",
"100355034692269131814304642060327042921"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2024-39497-86848fcf",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/drm_gem_shmem_helper.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b4a8b89bf6787090b56424d269bf84ba00c3263",
"deprecated": false,
"digest": {
"line_hashes": [
"256981891397702542449644603109832997629",
"239783900347116232115334741218041114709",
"100355034692269131814304642060327042921"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2024-39497-a017445b",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/drm_gem_shmem_helper.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2219e5f97244b79c276751a1167615b9714db1b0",
"deprecated": false,
"digest": {
"function_hash": "94924522370133136096552829985074396979",
"length": 546.0
},
"signature_version": "v1",
"id": "CVE-2024-39497-ab604938",
"signature_type": "Function",
"target": {
"file": "drivers/gpu/drm/drm_gem_shmem_helper.c",
"function": "drm_gem_shmem_mmap"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b4a8b89bf6787090b56424d269bf84ba00c3263",
"deprecated": false,
"digest": {
"function_hash": "147973357281029195972584045406323337715",
"length": 625.0
},
"signature_version": "v1",
"id": "CVE-2024-39497-d4d70c21",
"signature_type": "Function",
"target": {
"file": "drivers/gpu/drm/drm_gem_shmem_helper.c",
"function": "drm_gem_shmem_mmap"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ae63a8c1685e16958560ec08d30defdc5b9cca0",
"deprecated": false,
"digest": {
"function_hash": "100576135341019219826701944863710266247",
"length": 577.0
},
"signature_version": "v1",
"id": "CVE-2024-39497-f313a399",
"signature_type": "Function",
"target": {
"file": "drivers/gpu/drm/drm_gem_shmem_helper.c",
"function": "drm_gem_shmem_mmap"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03c71c42809ef4b17f5d874cdb2d3bf40e847b86",
"deprecated": false,
"digest": {
"function_hash": "147973357281029195972584045406323337715",
"length": 625.0
},
"signature_version": "v1",
"id": "CVE-2024-39497-f93cc71a",
"signature_type": "Function",
"target": {
"file": "drivers/gpu/drm/drm_gem_shmem_helper.c",
"function": "drm_gem_shmem_mmap"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a508a102edf8735adc9bb73d37dd13c38d1a1b10",
"deprecated": false,
"digest": {
"function_hash": "137960165190752162457680870736989272260",
"length": 594.0
},
"signature_version": "v1",
"id": "CVE-2024-39497-fc158456",
"signature_type": "Function",
"target": {
"file": "drivers/gpu/drm/drm_gem_shmem_helper.c",
"function": "drm_gem_shmem_mmap"
}
}
]