CVE-2024-58019

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvkm/gsp: correctly advance the read pointer of GSP message queue

A GSP event message consists three parts: message header, RPC header,

message body. GSP calculates the number of pages to write from the

total size of a GSP message. This behavior can be observed from the

movement of the write pointer.

However, nvkm takes only the size of RPC header and message body as

the message size when advancing the read pointer. When handling a

two-page GSP message in the non rollback case, It wrongly takes the

message body of the previous message as the message header of the next

message. As the "message length" tends to be zero, in the calculation of

size needs to be copied (0 - size of (message header)), the size needs to

be copied will be "0xffffffxx". It also triggers a kernel panic due to a

NULL pointer error.

[ 547.614102] msg: 00000f90: ff ff ff ff ff ff ff ff 40 d7 18 fb 8b 00 00 00 ........@.......

[ 547.622533] ms

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References