CVE-2024-50096

What it actually does

The nouveau_dmem_copy_one function sends a copy command via firmware without verifying execution success; on error it returns a dirty HIGH_USER page containing potentially sensitive or corrupted data to user space instead of a clean page.

Why it matters to the business

Systems using NVIDIA GPUs with the Nouveau driver may leak kernel or user memory contents to local processes, increasing risk of sensitive data exposure on Linux hosts that rely on device memory migration.

How an attack unfolds

An attacker with local access triggers memory migration to or from Nouveau device memory, forces a firmware or hardware copy failure, and receives a dirty page that may contain data from prior allocations.

How to fix it

Update the Linux kernel to the commit fd9bb7e996bab9b9049fffe3f3d3b50dee191d27 or later stable releases that allocate a zero page on copy error.

How to confirm the fix worked

Verify the running kernel contains commit fd9bb7e996bab9b9049fffe3f3d3b50dee191d27 and confirm migrate_to_ram returns a zero page on simulated copy failure.

Typical attack path

1. Obtain local execution on a Linux system with Nouveau driver loaded
2. Trigger page migration involving nouveau_dmem_copy_one
3. Induce or wait for a copy error condition in firmware/hardware
4. Receive and inspect the returned dirty HIGH_USER page for sensitive contents

How to detect it

Review kernel logs for nouveau dmem copy errors or migrate_to_ram warnings; inspect process memory dumps or page fault traces around migration events for unexpected non-zero content.

What your security team should do

• Apply the referenced kernel commit or newer distribution packages immediately on all affected systems
• Prioritize systems with NVIDIA GPUs using the Nouveau driver
• Monitor for new stable kernel releases containing the fix