CVE-2024-50096

In the Linux kernel, the following vulnerability has been resolved:

nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error

The nouveau_dmem_copy_one function ensures that the copy push command is sent to the device firmware but does not track whether it was executed successfully.

In the case of a copy error (e.g., firmware or hardware failure), the copy push command will be sent via the firmware channel, and nouveau_dmem_copy_one will likely report success, leading to the migrate_to_ram function returning a dirty HIGH_USER page to the user.

This can result in a security vulnerability, as a HIGH_USER page that may contain sensitive or corrupted data could be returned to the user.

To prevent this vulnerability, we allocate a zero page. Thus, in case of an error, a non-dirty (zero) page will be returned to the user.

This vulnerability is rated as Moderate severity because it requires local system access to exploit and depends on an underlying hardware or firmware failure during GPU memory migration. The affected code resides in the open-source Nouveau driver for NVIDIA graphics adapters, primarily used in desktop and workstation deployments rather than headless server installations. While an uninitialized page returned to user space may expose residual system data, the flaw does not allow direct privilege escalation or arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.