CVE-2024-42264

What it actually does

Missing upper-bound validation on the number of perfmon IDs supplied in V3D copy/reset performance-query extensions permits userspace to exceed the kernel's fixed-size internal storage array, resulting in out-of-bounds memory access.

Why it matters to the business

Linux systems that use Broadcom V3D GPUs can suffer kernel crashes, memory corruption, or local privilege escalation, disrupting graphics workloads and potentially compromising the entire host.

How an attack unfolds

An attacker with access to the DRM render node crafts a V3D_PERFMON copy or reset ioctl containing more perfmon identifiers than the kernel array can hold; the missing bounds check allows the copy to overwrite adjacent kernel memory, enabling further corruption or code execution.

How to fix it

Upgrade the Linux kernel to a version that includes commit 73ad583bd4938bf37d2709fc36901eb6f22f2722, which adds the required bounds check before copying perfmon IDs.

How to confirm the fix worked

Confirm the presence of the bounds-check patch in the v3d driver source; exercise the perfmon copy/reset paths with the maximum allowed count and verify no out-of-bounds access occurs.

Typical attack path

1. Obtain access to a V3D render device node
2. Prepare a malformed performance-query extension structure with an oversized perfmon count
3. Invoke the copy or reset ioctl to trigger the out-of-bounds write
4. Leverage the resulting memory corruption to escalate privileges or crash the kernel

How to detect it

Review kernel logs for V3D driver faults mentioning perfmon extensions or array overruns; correlate with unusual DRM ioctl activity from untrusted processes.

What your security team should do

• Apply the referenced kernel commit or later stable release to all affected hosts
• Restrict unprivileged access to DRM render nodes until patches are deployed
• Monitor kernel logs for V3D oops or warnings related to perfmon operations