In the Linux kernel, the following vulnerability has been resolved:
drm/msm/a6xx: Allocate enough space for GMU registers
In commit 142639a52a01 ("drm/msm/a6xx: fix crashstate capture for A650") we changed a6xx_get_gmu_registers() to read 3 sets of registers. Unfortunately, we didn't change the memory allocation for the array. That leads to a KASAN warning (this was on the chromeos-5.4 kernel, which has the problematic commit backported to it):
BUG: KASAN: slab-out-of-bounds in _a6xx_get_gmu_registers+0x144/0x430 Write of size 8 at addr ffffff80c89432b0 by task A618-worker/209 CPU: 5 PID: 209 Comm: A618-worker Tainted: G W 5.4.156-lockdep #22 Hardware name: Google Lazor Limozeen without Touchscreen (rev5 - rev8) (DT) Call trace: dump_backtrace+0x0/0x248 show_stack+0x20/0x2c dump_stack+0x128/0x1ec print_address_description+0x88/0x4a0 __kasan_report+0xfc/0x120 kasan_report+0x10/0x18 __asan_report_store8_noabort+0x1c/0x24 _a6xx_get_gmu_registers+0x144/0x430 a6xx_gpu_state_get+0x330/0x25d4 msm_gpu_crashstate_capture+0xa0/0x84c recover_worker+0x328/0x838 kthread_worker_fn+0x32c/0x574 kthread+0x2dc/0x39c ret_from_fork+0x10/0x18
Allocated by task 209: __kasan_kmalloc+0xfc/0x1c4 kasan_kmalloc+0xc/0x14 kmem_cache_alloc_trace+0x1f0/0x2a0 a6xx_gpu_state_get+0x164/0x25d4 msm_gpu_crashstate_capture+0xa0/0x84c recover_worker+0x328/0x838 kthread_worker_fn+0x32c/0x574 kthread+0x2dc/0x39c ret_from_fork+0x10/0x18
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Suse | — | Upgrade kernel-default-livepatchUpgrade kernel-macrosUpgrade kernel-default-develUpgrade kernel-rt-livepatch-develUpgrade dtb-broadcomUpgrade dtb-apmUpgrade kernel-azure-extraUpgrade kernel-64kb-optionalUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-vdsoUpgrade dtb-amlogicUpgrade kernel-zfcpdumpUpgrade dlm-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-default-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-syms-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-64kbUpgrade kernel-obs-buildUpgrade dtb-marvellUpgrade dlm-kmp-rtUpgrade dtb-renesasUpgrade dtb-freescaleUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-64kbUpgrade kernel-obs-qaUpgrade cluster-md-kmp-defaultUpgrade kernel-source-rtUpgrade kernel-default-extraUpgrade kernel-debugUpgrade dtb-appleUpgrade dtb-amazonUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-64kb-extraUpgrade kernel-rt_debug-develUpgrade dtb-socionextUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-debug-vdsoUpgrade kernel-default-baseUpgrade kernel-debug-develUpgrade kernel-docsUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade dtb-amdUpgrade kernel-defaultUpgrade dtb-hisiliconUpgrade reiserfs-kmp-defaultUpgrade dtb-sprdUpgrade kernel-azureUpgrade kernel-source-vanillaUpgrade kselftests-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-devel-azureUpgrade kernel-sourceUpgrade kernel-64kb-develUpgrade dtb-mediatekUpgrade ocfs2-kmp-azureUpgrade kernel-azure-develUpgrade kernel-devel-rtUpgrade reiserfs-kmp-azureUpgrade kernel-develUpgrade kernel-kvmsmallUpgrade kernel-rt-extraUpgrade cluster-md-kmp-azureUpgrade kernel-source-azureUpgrade ocfs2-kmp-rtUpgrade dtb-exynosUpgrade kernel-rt-develUpgrade kernel-symsUpgrade kernel-preempt-develUpgrade kernel-azure-optionalUpgrade dtb-alteraUpgrade kernel-default-optionalUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade dtb-qcomUpgrade dtb-caviumUpgrade kernel-rtUpgrade kernel-syms-azureUpgrade dtb-armUpgrade dtb-rockchipUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-azureUpgrade kernel-default-vdsoUpgrade dtb-lgUpgrade kernel-kvmsmall-develUpgrade dtb-allwinnerUpgrade gfs2-kmp-defaultUpgrade gfs2-kmp-rtUpgrade kernel-default-base-rebuildUpgrade dtb-xilinxUpgrade kernel-preempt | Aug 9, 2024 | May 24, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub