In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix use-after-free bug
The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was reported by Joonkyo Jung <[email protected]>. For example the following code:
static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; int ret;
arg.addr = 0xffffffffffff0000; arg.size = 0x80000000; /*2 Gb*/ arg.flags = 0x7; ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg); }
Due to the address and size are not valid there is a failure in amdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert-> check_shl_overflow, but we even the amdgpu_hmm_register failure we still call amdgpu_hmm_unregister into amdgpu_gem_object_free which causes access to a bad address. The following stack is below when the issue is reproduced when Kazan is enabled:
[ +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340 [ +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246 [ +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b [ +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260 [ +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25 [ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000 [ +0.000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0 [ +0.000010] Call Trace: [ +0.000006] <TASK> [ +0.000007] ? show_regs+0x6a/0x80 [ +0.000018] ? __warn+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000018] ? report_bug+0x24a/0x290 [ +0.000022] ? handle_bug+0x46/0x90 [ +0.000015] ? exc_invalid_op+0x19/0x50 [ +0.000016] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000017] ? kasan_save_stack+0x26/0x50 [ +0.000017] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000020] ? __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [ +0.000023] ? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __this_cpu_preempt_check+0x13/0x20 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? sysvec_apic_timer_interrupt+0x57/0xc0 [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.000022] ? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [d ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdumpUpgrade kernel-headersUpgrade kernel-rt-develUpgrade kernel-rt-debug-modulesUpgrade kernel-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-debugUpgrade kernel-debug-coreUpgrade kernel-develUpgrade kernel-rt-debugUpgrade kernel-debug-develUpgrade kernel-rt-debug-kvmUpgrade kernel-docUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-rt-coreUpgrade kernel-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-modules-extraUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-rtUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-rt-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-tools-libs-develUpgrade kernel-cross-headersUpgrade perfUpgrade kernel-rt-debug-coreUpgrade kernel | Jul 3, 2024 | Apr 2, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Apr 14, 2025 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perf | Jun 26, 2024 | Apr 2, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | Apr 2, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 3, 2024 | Apr 2, 2024 |
| Rocky_linux | — | Upgrade kernel-rtUpgrade bpftoolUpgrade perfUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-cross-headersUpgrade kernel-rt-kvmUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade python3-perfUpgrade kernel-rt-debug-modulesUpgrade kernel-coreUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-debug-coreUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-develUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade bpftool-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-tools-libsUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-kvm | Jul 16, 2024 | Apr 2, 2024 |
| Suse | — | Upgrade kernel-debug-vdsoUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-debugUpgrade kernel-default-baseUpgrade kernel-develUpgrade kernel-azureUpgrade reiserfs-kmp-defaultUpgrade dtb-renesasUpgrade dtb-caviumUpgrade kernel-source-vanillaUpgrade kernel-default-optionalUpgrade dtb-xilinxUpgrade kernel-azure-extraUpgrade kernel-source-rtUpgrade dtb-rockchipUpgrade kselftests-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-optionalUpgrade dtb-amdUpgrade kernel-rt-vdsoUpgrade dtb-broadcomUpgrade kernel-obs-buildUpgrade kernel-default-develUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-rtUpgrade dtb-nvidiaUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-develUpgrade dtb-sprdUpgrade kernel-sourceUpgrade reiserfs-kmp-64kbUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade dtb-allwinnerUpgrade kernel-docs-htmlUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-defaultUpgrade kernel-rt-develUpgrade kernel-default-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-alteraUpgrade dtb-exynosUpgrade dtb-hisiliconUpgrade gfs2-kmp-azureUpgrade dlm-kmp-rtUpgrade kernel-64kb-develUpgrade kernel-64kb-extraUpgrade kernel-debug-develUpgrade dtb-amazonUpgrade kernel-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-extraUpgrade dtb-amlogicUpgrade reiserfs-kmp-azureUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmallUpgrade kernel-docsUpgrade kernel-default-extraUpgrade kernel-azure-vdsoUpgrade kernel-azure-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-debug-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-64kbUpgrade gfs2-kmp-rtUpgrade dlm-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-devel-azureUpgrade kernel-symsUpgrade kernel-devel-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-syms-azureUpgrade dtb-socionextUpgrade kernel-azure-develUpgrade dtb-qcomUpgrade kernel-macrosUpgrade dtb-marvellUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade dtb-apmUpgrade kernel-rt_debugUpgrade kernel-rt-livepatch-develUpgrade dtb-mediatekUpgrade dtb-appleUpgrade reiserfs-kmp-rtUpgrade dtb-arm | May 15, 2024 | Apr 2, 2024 |
| Ubuntu | — | Upgrade linux-image-raspiUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-ibmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-genericUpgrade linux-image-oracleUpgrade linux-image-oem-24.04Upgrade linux-image-gkeUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-azure-fdeUpgrade linux-image-azureUpgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1006-oemUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-kvmUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1009-awsUpgrade linux-image-aws | Jul 1, 2024 | Apr 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub