CVE-2024-49984

What it actually does

Insufficient bounds checking on the number of performance monitors passed from userspace in DRM V3D performance query copy and reset extensions allows out-of-bounds memory access into internal kernel storage arrays.

Why it matters to the business

Systems using V3D graphics hardware face risk of kernel memory corruption that can cause crashes, instability, or local privilege escalation; low exploit likelihood reduces immediate operational disruption but still requires patching to maintain system integrity across Linux deployments.

How an attack unfolds

A local attacker interacts with the V3D DRM driver and submits a performance query extension ioctl containing more perfmon IDs than the kernel's internal storage can hold, bypassing the missing bounds check and triggering an out-of-bounds access that corrupts adjacent kernel memory for potential escalation.

How to fix it

Update the Linux kernel to a version containing commit 3e50d72abe50204c7b19784a66e86da29dde32c2 which adds the required bounds check on perfmon counts; apply distribution-specific updates for affected packages such as 389-ds-base when relevant.

How to confirm the fix worked

Confirm the running kernel contains commit 3e50d72abe50204c7b19784a66e86da29dde32c2 or equivalent backport; attempt to submit oversized perfmon counts via the performance query extensions and verify the operation is rejected before any copy occurs.

Typical attack path

1. Obtain local unprivileged access on a Linux system with V3D hardware
2. Open the DRM device and prepare a performance query extension structure
3. Populate the structure with an excessive number of perfmon IDs
4. Invoke the copy or reset ioctl to trigger the unchecked copy into kernel storage
5. Leverage resulting memory corruption to read or write kernel data structures
6. Escalate privileges or cause denial of service

How to detect it

Inspect kernel logs and audit records for drm/v3d related errors or warnings around performance query extensions; correlate unusual ioctl activity with process execution of graphics-related binaries.

What your security team should do

• Prioritize kernel updates on all systems exposing V3D graphics devices
• Review and restrict unprivileged access to DRM ioctls where feasible
• Include the fix in standard patch management cycles given stable low EPSS