CVE-2024-27008

What it actually does

Out-of-bounds read/write access to the dac_users array in the nv04 DRM driver when dcb->or evaluates to zero, because ffs(dcb->or) is used directly as an array index; the fabricate_dcb_output() 'or' parameter was being treated as a bit value instead of a bit position, and hardcoded constants were used instead of nouveau_or enum macros.

Why it matters to the business

Kernel crashes, potential local privilege escalation, or denial of service on Linux systems using the nouveau driver with certain NVIDIA hardware configurations; high prevalence in general-purpose Linux distributions increases exposure for servers, workstations, and embedded devices that have not applied the upstream fix.

How an attack unfolds

An attacker with local access or the ability to influence graphics device initialization triggers fabricate_dcb_output() with an 'or' argument of zero (or equivalent), causing ffs(0) to produce an invalid index into dac_users and resulting in memory corruption that can be leveraged for code execution or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit c2b97f26f081ceec3298151481687071075a25cb (or equivalent stable backport) for org/pub/scm/linux/kernel/git/stable/linux.git; for kakwa/ldapcherry apply commit 6f98076281e9452fdb1adcd1bcbb70a6f968ade9. Rebuild and reboot with the fixed kernel; verify nouveau driver initialization succeeds without oops.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit hashes via 'git log' or package version strings; exercise nouveau initialization paths on affected NVIDIA hardware and verify absence of out-of-bounds warnings or crashes in dmesg; re-run any static analysis or SVACE checks that originally identified the flaw.

Typical attack path

1. Obtain local code execution or control over graphics subsystem initialization
2. Cause the nv04 output resource fabrication path to be exercised with dcb->or set to zero
3. Trigger out-of-bounds array access via ffs(dcb->or) indexing into dac_users
4. Exploit resulting memory corruption for privilege escalation or kernel panic

How to detect it

Inspect kernel logs (dmesg, journalctl) for oops or BUG reports originating from drm/nv04 or fabricate_dcb_output during graphics initialization; correlate with hardware enumeration of NVIDIA devices and look for abnormal dac_users accesses or memory corruption symptoms.

What your security team should do

• Apply the referenced kernel commits immediately on all systems using the nouveau driver
• Prioritize patching for internet-facing or multi-user Linux hosts given the buffer overflow class
• Monitor upstream stable kernels for additional backports and schedule distribution updates
• Disable the nouveau driver or use vendor NVIDIA drivers where hardware permits as a temporary mitigation