CVE-2024-58018

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvkm: correctly calculate the available space of the GSP cmdq buffer

r535_gsp_cmdq_push() waits for the available page in the GSP cmdq

buffer when handling a large RPC request. When it sees at least one

available page in the cmdq, it quits the waiting with the amount of

free buffer pages in the queue.

Unfortunately, it always takes the [write pointer, buf_size) as

available buffer pages before rolling back and wrongly calculates the

size of the data should be copied. Thus, it can overwrite the RPC

request that GSP is currently reading, which causes GSP hang due

to corrupted RPC request:

[ 549.209389] ------------[ cut here ]------------

[ 549.214010] WARNING: CPU: 8 PID: 6314 at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:116 r535_gsp_msgq_wait+0xd0/0x190 [nvkm]

[ 549.225678] Modules linked in: nvkm(E+) gsp_log(E) snd_seq_dummy(E) snd_hrtimer(E) snd_seq(E) snd_timer(E) snd_seq_device(E) snd(E) soundcore(E) rf

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References