CVE-2024-56695 (GCVE-0-2024-56695)
Vulnerability from cvelistv5
Published
2024-12-28 09:46
Modified
2025-05-04 10:02
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Use dynamic allocation for CU occupancy array in 'kfd_get_cu_occupancy()' The `kfd_get_cu_occupancy` function previously declared a large `cu_occupancy` array as a local variable, which could lead to stack overflows due to excessive stack usage. This commit replaces the static array allocation with dynamic memory allocation using `kcalloc`, thereby reducing the stack size. This change avoids the risk of stack overflows in kernel space, in scenarios where `AMDGPU_MAX_QUEUES` is large. The allocated memory is freed using `kfree` before the function returns to prevent memory leaks. Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c: In function ‘kfd_get_cu_occupancy’: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c:322:1: warning: the frame size of 1056 bytes is larger than 1024 bytes [-Wframe-larger-than=] 322 | } | ^
References
Impacted products
Vendor Product Version
Linux Linux Version: 6ae9e1aba97e4cdaa31a0bfdc07497ad0e915c84
Version: 6ae9e1aba97e4cdaa31a0bfdc07497ad0e915c84
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_process.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6d9f07196389f35a3afebcf1a12c1425725caddd",
              "status": "affected",
              "version": "6ae9e1aba97e4cdaa31a0bfdc07497ad0e915c84",
              "versionType": "git"
            },
            {
              "lessThan": "922f0e00017b09d9d47e3efac008c8b20ed546a0",
              "status": "affected",
              "version": "6ae9e1aba97e4cdaa31a0bfdc07497ad0e915c84",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_process.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Use dynamic allocation for CU occupancy array in \u0027kfd_get_cu_occupancy()\u0027\n\nThe `kfd_get_cu_occupancy` function previously declared a large\n`cu_occupancy` array as a local variable, which could lead to stack\noverflows due to excessive stack usage. This commit replaces the static\narray allocation with dynamic memory allocation using `kcalloc`,\nthereby reducing the stack size.\n\nThis change avoids the risk of stack overflows in kernel space,  in\nscenarios where `AMDGPU_MAX_QUEUES` is large. The  allocated memory is\nfreed using `kfree` before the function returns  to prevent memory\nleaks.\n\nFixes the below with gcc W=1:\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c: In function \u2018kfd_get_cu_occupancy\u2019:\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c:322:1: warning: the frame size of 1056 bytes is larger than 1024 bytes [-Wframe-larger-than=]\n  322 | }\n      | ^"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T10:02:33.454Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6d9f07196389f35a3afebcf1a12c1425725caddd"
        },
        {
          "url": "https://git.kernel.org/stable/c/922f0e00017b09d9d47e3efac008c8b20ed546a0"
        }
      ],
      "title": "drm/amdkfd: Use dynamic allocation for CU occupancy array in \u0027kfd_get_cu_occupancy()\u0027",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56695",
    "datePublished": "2024-12-28T09:46:19.468Z",
    "dateReserved": "2024-12-27T15:00:39.850Z",
    "dateUpdated": "2025-05-04T10:02:33.454Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56695\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-28T10:15:15.533\",\"lastModified\":\"2025-03-05T18:53:08.307\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdkfd: Use dynamic allocation for CU occupancy array in \u0027kfd_get_cu_occupancy()\u0027\\n\\nThe `kfd_get_cu_occupancy` function previously declared a large\\n`cu_occupancy` array as a local variable, which could lead to stack\\noverflows due to excessive stack usage. This commit replaces the static\\narray allocation with dynamic memory allocation using `kcalloc`,\\nthereby reducing the stack size.\\n\\nThis change avoids the risk of stack overflows in kernel space,  in\\nscenarios where `AMDGPU_MAX_QUEUES` is large. The  allocated memory is\\nfreed using `kfree` before the function returns  to prevent memory\\nleaks.\\n\\nFixes the below with gcc W=1:\\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c: In function \u2018kfd_get_cu_occupancy\u2019:\\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c:322:1: warning: the frame size of 1056 bytes is larger than 1024 bytes [-Wframe-larger-than=]\\n  322 | }\\n      | ^\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdkfd: Uso de asignaci\u00f3n din\u00e1mica para la matriz de ocupaci\u00f3n de CU en \u0027kfd_get_cu_occupancy()\u0027 La funci\u00f3n `kfd_get_cu_occupancy` declar\u00f3 anteriormente una matriz `cu_occupancy` grande como una variable local, lo que podr\u00eda provocar desbordamientos de pila debido al uso excesivo de la pila. Esta confirmaci\u00f3n reemplaza la asignaci\u00f3n de matriz est\u00e1tica con asignaci\u00f3n de memoria din\u00e1mica utilizando `kcalloc`, lo que reduce el tama\u00f1o de la pila. Este cambio evita el riesgo de desbordamientos de pila en el espacio del kernel, en escenarios donde `AMDGPU_MAX_QUEUES` es grande. La memoria asignada se libera utilizando `kfree` antes de que la funci\u00f3n regrese para evitar fugas de memoria. Corrige lo siguiente con gcc W=1: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c: En la funci\u00f3n \u0027kfd_get_cu_occupancy\u0027: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c:322:1: advertencia: el tama\u00f1o del marco de 1056 bytes es mayor que 1024 bytes [-Wframe-larger-than=] 322 | } | ^\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6d9f07196389f35a3afebcf1a12c1425725caddd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\",\"Mailing List\"]},{\"url\":\"https://git.kernel.org/stable/c/922f0e00017b09d9d47e3efac008c8b20ed546a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\",\"Mailing List\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.