CVE-2024-50187

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Stop the active perfmon before being destroyed

Upon closing the file descriptor, the active performance monitor is not

stopped. Although all perfmons are destroyed in `vc4_perfmon_close_file()`,

the active performance monitor's pointer (`vc4->active_perfmon`) is still

retained.

If we open a new file descriptor and submit a few jobs with performance

monitors, the driver will attempt to stop the active performance monitor

using the stale pointer in `vc4->active_perfmon`. However, this pointer

is no longer valid because the previous process has already terminated,

and all performance monitors associated with it have been destroyed and

freed.

To fix this, when the active performance monitor belongs to a given

process, explicitly stop it before destroying and freeing it.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References