CVE-2024-52559

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerability is reached only through the DRM_IOCTL_MSM_GEM_SUBMIT ioctl on a local /dev/dri/renderD* device node; there is no network or adjacent-network path to msm_ioctl_gem_submit().

AC:LAttack complexity, low

Triggering requires only a single crafted ioctl with a size/offset pair whose 32-bit sum wraps, with no race, no timing window, and no dependence on memory layout the attacker cannot influence; the attacker also controls its own GPU address space allocations to position the resulting IB target.

PR:LPrivileges required, low

The ioctl is registered DRM_RENDER_ALLOW with no DRM_AUTH, DRM_MASTER, or capability check, so any unprivileged process with an open render node fd qualifies — including sandboxed Android untrusted_app processes and ChromeOS GPU/renderer processes on Snapdragon hardware.

UI:NUser interaction, none

The attacking process performs the entire sequence itself by opening the render node and issuing the submit ioctl; no action by any other user is needed.

S:UScope, unchanged

The GPU SMMU is not bypassed — the bogus IB address is still translated by the GPU page tables — so the impact remains within the kernel's own security authority rather than crossing into a different one.

C:HConfidentiality impact, high

The wrap yields an attacker-chosen GPU virtual address and length for CP_INDIRECT_BUFFER_PFE, letting the GPU fetch and execute command packets from memory outside the submitted buffer object, including other GPU clients' buffers and kernel-owned GPU structures, whose contents can be exfiltrated via memory-copy packets.

I:HIntegrity impact, high

Executing command packets sourced from out-of-bounds memory allows GPU-side writes (CP_MEM_WRITE and similar) to arbitrary mapped GPU addresses, corrupting other clients' buffers as well as kernel ringbuffer/memptr/fence state.

A:HAvailability impact, high

Pointing the indirect buffer at unmapped GPU VA causes an SMMU translation fault, GPU hang, devcoredump and recovery, which an unprivileged process can trigger repeatedly to wedge graphics and compute on the device.