In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix use-after-free bug
The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was reported by Joonkyo Jung <[email protected]>. For example the following code:
static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; int ret;
arg.addr = 0xffffffffffff0000; arg.size = 0x80000000; /*2 Gb*/ arg.flags = 0x7; ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg); }
Due to the address and size are not valid there is a failure in amdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert-> check_shl_overflow, but we even the amdgpu_hmm_register failure we still call amdgpu_hmm_unregister into amdgpu_gem_object_free which causes access to a bad address. The following stack is below when the issue is reproduced when Kazan is enabled:
[ +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340 [ +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246 [ +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b [ +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260 [ +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25 [ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000 [ +0.000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0 [ +0.000010] Call Trace: [ +0.000006] <TASK> [ +0.000007] ? show_regs+0x6a/0x80 [ +0.000018] ? __warn+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000018] ? report_bug+0x24a/0x290 [ +0.000022] ? handle_bug+0x46/0x90 [ +0.000015] ? exc_invalid_op+0x19/0x50 [ +0.000016] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000017] ? kasan_save_stack+0x26/0x50 [ +0.000017] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000020] ? __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [ +0.000023] ? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __this_cpu_preempt_check+0x13/0x20 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? sysvec_apic_timer_interrupt+0x57/0xc0 [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.000022] ? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [d ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-modulesUpgrade kernel-rt-debugUpgrade kernel-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libsUpgrade kernel-debug-modules-extraUpgrade kernel-docUpgrade kernel-coreUpgrade kernel-headersUpgrade kernel-rt-coreUpgrade kernel-rt-develUpgrade kernel-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-develUpgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-kvmUpgrade kernel-toolsUpgrade perfUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernelUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-modulesUpgrade kernel-cross-headers | Jul 3, 2024 | Apr 2, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Apr 14, 2025 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Jun 26, 2024 | Apr 2, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | Apr 2, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 3, 2024 | Apr 2, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debug-coreUpgrade kernel-cross-headersUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernelUpgrade kernel-rt-kvmUpgrade perfUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-debug-modules-extraUpgrade kernel-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-debug-modulesUpgrade bpftool-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debug-develUpgrade kernel-debug-develUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debuginfoUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-debugUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-debug-debuginfoUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-rt-debug | Jul 16, 2024 | Apr 2, 2024 |
| Suse | — | Upgrade dtb-broadcomUpgrade kernel-debug-vdsoUpgrade dtb-renesasUpgrade dtb-amdUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-develUpgrade kernel-rt-develUpgrade dtb-amazonUpgrade kernel-source-vanillaUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-rt-livepatchUpgrade kselftests-kmp-azureUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-64kbUpgrade kernel-default-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-source-rtUpgrade kernel-obs-buildUpgrade kernel-rt_debug-develUpgrade dtb-xilinxUpgrade kernel-rt-vdsoUpgrade reiserfs-kmp-defaultUpgrade dtb-sprdUpgrade kernel-default-vdsoUpgrade kernel-default-optionalUpgrade reiserfs-kmp-64kbUpgrade kernel-64kb-develUpgrade kernel-azure-extraUpgrade dtb-rockchipUpgrade kernel-source-azureUpgrade kselftests-kmp-64kbUpgrade dtb-allwinnerUpgrade gfs2-kmp-azureUpgrade kernel-defaultUpgrade dtb-hisiliconUpgrade kernel-debug-develUpgrade dtb-exynosUpgrade dtb-nvidiaUpgrade kernel-debugUpgrade kernel-sourceUpgrade kernel-kvmsmall-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade dtb-lgUpgrade kernel-docs-htmlUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-rtUpgrade dtb-caviumUpgrade kernel-azure-optionalUpgrade kernel-azureUpgrade dlm-kmp-64kbUpgrade kernel-default-baseUpgrade kernel-rt-extraUpgrade dtb-freescaleUpgrade kernel-default-livepatch-develUpgrade dtb-alteraUpgrade kernel-kvmsmall-develUpgrade dtb-armUpgrade dlm-kmp-azureUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-rtUpgrade dtb-apmUpgrade kselftests-kmp-rtUpgrade kernel-docsUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-64kbUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-64kbUpgrade kernel-symsUpgrade kernel-obs-qaUpgrade kselftests-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-devel-rtUpgrade kernel-64kb-livepatch-develUpgrade dtb-socionextUpgrade kernel-devel-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-syms-rtUpgrade dtb-marvellUpgrade kernel-azure-develUpgrade dtb-qcomUpgrade kernel-macrosUpgrade reiserfs-kmp-rtUpgrade dtb-mediatekUpgrade kernel-rt_debugUpgrade kernel-rt-livepatch-develUpgrade dtb-appleUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-azure-livepatch-develUpgrade reiserfs-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade kernel-default-extra | May 15, 2024 | Apr 2, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-gcpUpgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-6.8.0-1006-oemUpgrade linux-image-oracle-64kUpgrade linux-image-azureUpgrade linux-image-azure-fdeUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1009-awsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-kvmUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-gkeUpgrade linux-image-oracleUpgrade linux-image-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-generic | Jul 1, 2024 | Apr 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 2, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub