In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix use-after-free bug
The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was reported by Joonkyo Jung <[email protected]>. For example the following code:
static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; int ret;
arg.addr = 0xffffffffffff0000; arg.size = 0x80000000; /*2 Gb*/ arg.flags = 0x7; ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg); }
Due to the address and size are not valid there is a failure in amdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert-> check_shl_overflow, but we even the amdgpu_hmm_register failure we still call amdgpu_hmm_unregister into amdgpu_gem_object_free which causes access to a bad address. The following stack is below when the issue is reproduced when Kazan is enabled:
[ +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340 [ +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246 [ +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b [ +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260 [ +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25 [ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000 [ +0.000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0 [ +0.000010] Call Trace: [ +0.000006] <TASK> [ +0.000007] ? show_regs+0x6a/0x80 [ +0.000018] ? __warn+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000018] ? report_bug+0x24a/0x290 [ +0.000022] ? handle_bug+0x46/0x90 [ +0.000015] ? exc_invalid_op+0x19/0x50 [ +0.000016] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000017] ? kasan_save_stack+0x26/0x50 [ +0.000017] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000020] ? __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [ +0.000023] ? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __this_cpu_preempt_check+0x13/0x20 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? sysvec_apic_timer_interrupt+0x57/0xc0 [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.000022] ? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [d ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-modules-extraUpgrade kernel-debug-develUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-docUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debugUpgrade kernel-rt-debug-develUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-coreUpgrade kernel-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-modulesUpgrade kernel-rt-modulesUpgrade kernel-rt-kvmUpgrade kernel-cross-headersUpgrade perfUpgrade kernel-rtUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade python3-perfUpgrade kernel-rt-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade kernel-tools-libs-develUpgrade kernel-tools | Jul 3, 2024 | Apr 2, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Apr 14, 2025 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftool | Jun 26, 2024 | Apr 2, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | Apr 2, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Jul 3, 2024 | Apr 2, 2024 |
| Rocky_linux | — | Upgrade python3-perfUpgrade kernel-rtUpgrade kernel-cross-headersUpgrade kernel-rt-debug-coreUpgrade bpftoolUpgrade kernel-rt-modules-extraUpgrade kernel-rt-kvmUpgrade perfUpgrade kernel-tools-libs-develUpgrade kernel-toolsUpgrade kernelUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-debug-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-modulesUpgrade kernel-tools-libsUpgrade kernel-coreUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade bpftool-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rt-debugUpgrade kernel-headersUpgrade kernel-debug-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-devel | Jul 16, 2024 | Apr 2, 2024 |
| Suse | — | Upgrade ocfs2-kmp-64kbUpgrade dtb-xilinxUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-obs-buildUpgrade kernel-debug-vdsoUpgrade dtb-broadcomUpgrade dtb-amdUpgrade kselftests-kmp-azureUpgrade kernel-rt-optionalUpgrade kernel-source-vanillaUpgrade kernel-rt-develUpgrade kernel-default-baseUpgrade kernel-develUpgrade kernel-default-optionalUpgrade dtb-renesasUpgrade dtb-amazonUpgrade dtb-caviumUpgrade reiserfs-kmp-defaultUpgrade kernel-azureUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-develUpgrade dtb-nvidiaUpgrade dtb-hisiliconUpgrade dtb-exynosUpgrade kernel-defaultUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade kernel-azure-extraUpgrade dtb-alteraUpgrade kernel-64kb-develUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-default-livepatchUpgrade reiserfs-kmp-64kbUpgrade dtb-sprdUpgrade dtb-lgUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-freescaleUpgrade dlm-kmp-64kbUpgrade kernel-debugUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-sourceUpgrade kernel-docs-htmlUpgrade kernel-rt-extraUpgrade kernel-default-vdsoUpgrade kernel-rt-livepatchUpgrade kernel-default-livepatch-develUpgrade kernel-default-develUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debugUpgrade dtb-amlogicUpgrade dtb-appleUpgrade dtb-mediatekUpgrade kernel-64kb-livepatch-develUpgrade kselftests-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade dtb-socionextUpgrade kernel-devel-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-obs-qaUpgrade ocfs2-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-syms-rtUpgrade gfs2-kmp-rtUpgrade kernel-default-base-rebuildUpgrade kernel-64kbUpgrade kernel-azure-develUpgrade kernel-64kb-optionalUpgrade dlm-kmp-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-macrosUpgrade dtb-qcomUpgrade gfs2-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade dtb-marvellUpgrade dlm-kmp-defaultUpgrade kernel-docsUpgrade reiserfs-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-default-extraUpgrade dtb-apmUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade dtb-arm | May 15, 2024 | Apr 2, 2024 |
| Ubuntu | — | Upgrade linux-image-oracleUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-gkeUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-generic-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1006-oemUpgrade linux-image-ibmUpgrade linux-image-genericUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-azureUpgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-gcpUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-ibm-classicUpgrade linux-image-awsUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-virtualUpgrade linux-image-kvm | Jul 1, 2024 | Apr 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub