LiveActive security incident?Get immediate response
CVE Record

CVE-2024-27008: drm: nv04: Fix out of bounds access

In the Linux kernel, the following vulnerability has been resolved: drm: nv04: Fix out of bounds access When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value. Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. Found by Linux Verification Center (linuxtesting.org) with SVACE.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-27008 is a Linux kernel DRM/Nouveau nv04 bug that can cause an out-of-bounds array access. The public sources do not provide CVSS, impact, or active exploitation evidence. Treat it as a kernel memory-safety issue requiring normal kernel patch management, especially where affected Linux versions are deployed.

Executive priority

Handle through routine but timely kernel update cycles. Escalate if affected systems are high-value workstations, shared graphical hosts, or environments where kernel faults create operational disruption.

Technical view

The issue is in fabricate_dcb_output(): dcb->or could be zero, and ffs(dcb->or) was used as an index into dac_users, creating out-of-bounds access. The fix interprets the or argument as a bit number and uses nouveau_or enum macros instead of hardcoded values.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with the DRM/Nouveau nv04 code path present or used. The bundle lists affected Linux versions from 2.6.38 through 6.9, with stable kernel commits and Debian/Fedora advisories referenced.

Exploitation context

No source in the bundle reports active exploitation, and CISA KEV status is false. The vulnerability was reported as found by Linux Verification Center using SVACE. Public evidence here does not establish exploit prerequisites, attacker position, or practical impact.

Researcher notes

The provided record lacks CVSS, CWE, exploitability details, and concrete impact statements. Analysis should stay close to the commit rationale: zero dcb->or leading to an invalid dac_users index through ffs(). Validate fixes by source commit or distro backport evidence.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable commits.
  • Prioritize Debian and Fedora systems covered by the listed advisories.
  • Check Linux distribution guidance for fixed package versions.
  • Review whether Nouveau DRM support is needed on exposed systems.

Validation and detection

  • Inventory Linux kernel versions across servers, workstations, and images.
  • Identify systems using affected kernel ranges listed in the CVE bundle.
  • Confirm installed kernels include the relevant stable fix commit or vendor backport.
  • Check distro security advisories for package-level remediation status.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-27008 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
14Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2e5702aff39532662198459726c624d5eadbdd78, 2e5702aff39532662198459726c624d5eadbdd78, 2e5702aff39532662198459726c624d5eadbdd78, 2e5702aff39532662198459726c624d5eadbdd78, 2e5702aff39532662198459726c624d5eadbdd78, 2e5702aff39532662198459726c624d5eadbdd78, 2e5702aff39532662198459726c624d5eadbdd78, 2e5702aff39532662198459726c624d5eadbdd78unaffected
LinuxLinux2.6.38, 0, 4.19.313, 5.4.275, 5.10.216, 5.15.157, 6.1.88, 6.6.29, 6.8.8, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.