CVE-2024-50090

What it actually does

Repeated unconditional appending of MI_BATCH_BUFFER_END in xe_bb_create_job leads to unchecked growth of the batch buffer beyond its allocated size, triggering an assertion failure and subsequent memory corruption in the drm/xe OA path.

Why it matters to the business

Systems using affected Intel Xe graphics hardware may experience kernel panics or instability during repeated graphics metric collection workloads, increasing downtime risk and potential for local privilege escalation in multi-tenant environments.

How an attack unfolds

An attacker triggers repeated OA batch buffer reuse by issuing graphics metric queries or rendering operations that invoke xe_bb_create_job multiple times; each call appends an extra MI_BATCH_BUFFER_END without a prior check, overflowing the buffer and allowing controlled memory corruption that can be leveraged for code execution.

How to fix it

Update the Linux kernel to commit bcb5be3421705e682b0b32073ad627056d6bc2a2 or later stable releases that include the check for existing MI_BATCH_BUFFER_END before appending.

How to confirm the fix worked

Confirm the kernel source contains the conditional check before MI_BATCH_BUFFER_END append in xe_bb_create_job and verify the assertion no longer triggers under repeated OA batch buffer reuse.

Typical attack path

1. Gain local access on a Linux system with Intel Xe (LUNARLAKE or similar) graphics
2. Trigger graphics workloads that repeatedly exercise the OA metric path
3. Cause repeated calls to xe_bb_create_job without buffer reset
4. Overflow batch buffer leading to assertion failure and memory corruption
5. Leverage corruption for privilege escalation or denial of service

How to detect it

Search kernel logs and dmesg for the assertion failure message containing bb->len * 4 + bb_prefetch and xe driver warnings on LUNARLAKE or Xe2 platforms; correlate with processes performing repeated OA or graphics metric operations.

• xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed!
• platform: LUNARLAKE
• xe_bb_create_job

What your security team should do

• Prioritize kernel upgrade on all systems exposing Intel Xe graphics to users
• Monitor dmesg and kernel logs for the xe assertion failure string
• Restrict unprivileged access to graphics metric interfaces until patched