CVE-2024-42264

An out-of-bounds access buffer overflow vulnerability exists in the performance query extensions in the Linux kernel. This issue can lead to a loss of system availability.

A moderate impact out-of-bounds access vulnerability was found in the Linux kernel v3d DRM driver. The performance monitor (perfmon) query copy and reset extensions did not check that the number of perfmons passed by userspace fits the internal kernel storage into which the perfmon IDs are copied, so a local user with the required privileges could trigger an out-of-bounds access, potentially exposing kernel memory contents and affecting system availability. Red Hat assesses this flaw as moderate severity (CVSS 6.0), while NIST and the CVE record assign higher scores (7.1 and 7.8, important); the difference is driven mainly by the Privileges Required metric, which Red Hat assesses as high (PR:H) versus low (PR:L) upstream. The vulnerable code was introduced upstream in Linux kernel version 6.8. Within the Red Hat portfolio only Fedora is affected, and a fix is being pursued for Fedora through the delegated community maintenance process; all Red Hat Enterprise Linux kernel and kernel-rt streams, as well as the hosted OpenShift environments, are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.