CVE-2024-46837

What it actually does

Missing permission checks in the Panthor DRM driver's group_create ioctl allowed unprivileged users to create high-priority groups exceeding PANTHOR_GROUP_PRIORITY_MEDIUM, bypassing authorization and enabling resource starvation.

Why it matters to the business

Attackers on affected Linux systems can degrade graphics and system performance, resulting in denial of service that disrupts user workloads and requires administrative intervention to restore service.

How an attack unfolds

An attacker with a local unprivileged account invokes the panthor_group_create ioctl directly with a high priority value; because no DRM master or CAP_SYS_NICE check existed, the kernel accepted the request and scheduled the group at elevated priority, allowing it to contend for GPU resources and cause denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 33eb0344e186a2bcc257c6c5a6e65c1cb42adb4a or later; the fix moves priority authorization checks into the ioctl handler and restricts values above MEDIUM to the DRM master or processes holding CAP_SYS_NICE.

How to confirm the fix worked

Confirm the running kernel contains commit 33eb0344e186a2bcc257c6c5a6e65c1cb42adb4a, then verify that non-master users without CAP_SYS_NICE receive an error when attempting to create groups with priority above MEDIUM.

Typical attack path

1. Obtain a local user account on a system running the vulnerable kernel with Panthor DRM enabled
2. Locate or compile code that calls the DRM panthor_group_create ioctl
3. Supply a priority value higher than MEDIUM in the ioctl request
4. Trigger repeated high-priority group creation to starve GPU resources
5. Observe system-wide graphics or scheduling degradation

How to detect it

Review kernel audit logs and dmesg for panthor ioctl activity; look for group creation requests specifying priority values above MEDIUM originating from non-master processes lacking CAP_SYS_NICE.

What your security team should do

• Apply the fixed kernel commit or distribution update immediately on all systems exposing Panthor DRM
• Audit local users and services for unnecessary CAP_SYS_NICE grants
• Monitor for unexpected high-priority DRM group creation attempts via auditd or kernel logging
• Restrict direct access to DRM device nodes to trusted users only