In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix use-after-free bug
The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was reported by Joonkyo Jung <[email protected]>. For example the following code:
static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; int ret;
arg.addr = 0xffffffffffff0000; arg.size = 0x80000000; /*2 Gb*/ arg.flags = 0x7; ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg); }
Due to the address and size are not valid there is a failure in amdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert-> check_shl_overflow, but we even the amdgpu_hmm_register failure we still call amdgpu_hmm_unregister into amdgpu_gem_object_free which causes access to a bad address. The following stack is below when the issue is reproduced when Kazan is enabled:
[ +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340 [ +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246 [ +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b [ +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260 [ +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25 [ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000 [ +0.000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0 [ +0.000010] Call Trace: [ +0.000006] <TASK> [ +0.000007] ? show_regs+0x6a/0x80 [ +0.000018] ? __warn+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000018] ? report_bug+0x24a/0x290 [ +0.000022] ? handle_bug+0x46/0x90 [ +0.000015] ? exc_invalid_op+0x19/0x50 [ +0.000016] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000017] ? kasan_save_stack+0x26/0x50 [ +0.000017] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000020] ? __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [ +0.000023] ? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __this_cpu_preempt_check+0x13/0x20 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? sysvec_apic_timer_interrupt+0x57/0xc0 [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.000022] ? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [d ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-perfUpgrade bpftoolUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-toolsUpgrade kernel-zfcpdump-coreUpgrade kernel-abi-stablelistsUpgrade kernel-cross-headersUpgrade kernel-rt-kvmUpgrade kernelUpgrade kernel-rtUpgrade perfUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade kernel-debug-modules-extraUpgrade kernel-docUpgrade kernel-modulesUpgrade kernel-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-headersUpgrade kernel-develUpgrade kernel-zfcpdumpUpgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-develUpgrade kernel-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-debugUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debugUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-debug-modulesUpgrade kernel-tools-libs | Jul 3, 2024 | Apr 2, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Apr 14, 2025 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Jun 26, 2024 | Apr 2, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | Apr 2, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Jul 3, 2024 | Apr 2, 2024 |
| Rocky_linux | — | Upgrade python3-perfUpgrade kernel-tools-libs-develUpgrade kernel-toolsUpgrade perfUpgrade kernelUpgrade kernel-rt-debug-coreUpgrade kernel-cross-headersUpgrade kernel-rt-kvmUpgrade bpftoolUpgrade kernel-rt-modules-extraUpgrade kernel-rtUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-libsUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-modulesUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-rt-develUpgrade kernel-debug-develUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debugUpgrade kernel-rt-debug-develUpgrade bpftool-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-headersUpgrade kernel-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rt-coreUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extra | Jul 16, 2024 | Apr 2, 2024 |
| Suse | — | Upgrade kernel-kvmsmallUpgrade kernel-obs-qaUpgrade kernel-syms-azureUpgrade kernel-devel-rtUpgrade kernel-devel-azureUpgrade kernel-zfcpdumpUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-rtUpgrade reiserfs-kmp-rtUpgrade dtb-armUpgrade kernel-default-extraUpgrade cluster-md-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-livepatch-develUpgrade dtb-qcomUpgrade kernel-azure-develUpgrade kernel-rt_debugUpgrade gfs2-kmp-64kbUpgrade kernel-64kbUpgrade kernel-kvmsmall-develUpgrade dtb-marvellUpgrade kernel-macrosUpgrade kernel-rtUpgrade kernel-rt-livepatch-develUpgrade dtb-amlogicUpgrade dtb-apmUpgrade dtb-mediatekUpgrade kernel-64kb-livepatch-develUpgrade dtb-socionextUpgrade kselftests-kmp-defaultUpgrade dtb-appleUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-symsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-syms-rtUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade ocfs2-kmp-rtUpgrade kernel-docsUpgrade cluster-md-kmp-rtUpgrade dtb-sprdUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-allwinnerUpgrade kernel-rt-livepatchUpgrade dtb-freescaleUpgrade dtb-amdUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-default-livepatchUpgrade dtb-xilinxUpgrade ocfs2-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-develUpgrade kernel-default-livepatch-develUpgrade dtb-lgUpgrade reiserfs-kmp-64kbUpgrade dtb-caviumUpgrade kernel-64kb-develUpgrade dtb-rockchipUpgrade kselftests-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade kernel-azure-extraUpgrade kernel-debug-develUpgrade kernel-defaultUpgrade dtb-nvidiaUpgrade dtb-hisiliconUpgrade dtb-exynosUpgrade dtb-alteraUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-default-vdsoUpgrade gfs2-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-default-optionalUpgrade kernel-default-baseUpgrade kernel-azureUpgrade dtb-renesasUpgrade dlm-kmp-rtUpgrade dtb-amazonUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-develUpgrade dtb-broadcomUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-rt-optionalUpgrade kernel-obs-buildUpgrade kernel-default-develUpgrade ocfs2-kmp-defaultUpgrade kernel-debug-vdsoUpgrade kernel-sourceUpgrade kernel-docs-htmlUpgrade kernel-debugUpgrade kernel-64kb-extraUpgrade dlm-kmp-64kb | May 15, 2024 | Apr 2, 2024 |
| Ubuntu | — | Upgrade linux-image-raspiUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-oracleUpgrade linux-image-oem-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-genericUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-oem-24.04aUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-awsUpgrade linux-image-azureUpgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1006-oemUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-virtualUpgrade linux-image-virtual-hwe-24.04 | Jul 1, 2024 | Apr 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub