Security readout for executives and security teams
Plain-English summary
A race condition in Linux’s open-source nouveau graphics driver can corrupt kernel object handling and crash the system. The supplied CVSS assessment also allows potential confidentiality and integrity impact from a local, low-privileged user. Systems not using nouveau are unlikely to be exposed through this flaw.
Executive priority
Treat as a high-priority maintenance issue on multi-user systems using nouveau, especially where untrusted users run GPU workloads. Patch through normal emergency kernel processes after compatibility testing. Systems without nouveau can be deprioritized once driver usage is verified.
Technical view
The nouveau driver lacked locking around its client object tree. Concurrent addition and removal of objects, primarily VRAM BAR mappings, could leave invalid state during object lookup. The documented failure is a general protection fault in nvkm_object_search. Referenced stable-kernel commits add the required locking.
Likely exposure
Exposure is limited to Linux systems running an affected kernel with the nouveau driver in use, generally for supported NVIDIA graphics hardware. The source identifies affected kernel versions but does not provide reliable distribution-package mappings; administrators must confirm backports with their Linux vendor.
Exploitation context
The CVSS vector describes local access, low privileges, low complexity, and no user interaction. The supplied evidence demonstrates a kernel crash during graphics activity, but does not establish a practical privilege-escalation technique. This CVE is not listed as KEV, and no active exploitation is reported in the bundle.
Researcher notes
The evidence supports a concurrency flaw and observed kernel fault, but not proven code execution or exploitation in the wild. Exact vulnerable and fixed distribution builds remain unspecified. Analysis should focus on fix backport verification, object-lifetime synchronization, and crash telemetry without treating the CVSS impact assumptions as demonstrated exploitation.
Mitigation direction
- Install a supported vendor kernel package incorporating the referenced nouveau locking fix.
- Check distribution security guidance for exact fixed package versions and backport status.
- Prioritize shared workstations or compute systems where untrusted local users can access nouveau.
- Use only vendor-approved exposure reductions if an immediate kernel update is unavailable.
Validation and detection
- Inventory systems loading nouveau and record their kernel and distribution package versions.
- Confirm the installed package contains one of the referenced fixes or an equivalent vendor backport.
- Review kernel logs for protection faults involving nvkm_object_search, nvkm_ioctl, or nouveau_ttm_fault.
- After updating, verify the fixed kernel is running and nouveau-dependent workloads operate normally.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27062 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6887314f5356389fc219b8152e951ac084a10ef7CVE reference, Linux
- https://git.kernel.org/stable/c/96c8751844171af4b3898fee3857ee180586f589CVE reference, Linux
- https://git.kernel.org/stable/c/b7cc4ff787a572edf2c55caeffaa88cd801eb135CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.