In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix use-after-free bug
The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was reported by Joonkyo Jung <[email protected]>. For example the following code:
static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; int ret;
arg.addr = 0xffffffffffff0000; arg.size = 0x80000000; /*2 Gb*/ arg.flags = 0x7; ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg); }
Due to the address and size are not valid there is a failure in amdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert-> check_shl_overflow, but we even the amdgpu_hmm_register failure we still call amdgpu_hmm_unregister into amdgpu_gem_object_free which causes access to a bad address. The following stack is below when the issue is reproduced when Kazan is enabled:
[ +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340 [ +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246 [ +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b [ +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260 [ +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25 [ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000 [ +0.000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0 [ +0.000010] Call Trace: [ +0.000006] <TASK> [ +0.000007] ? show_regs+0x6a/0x80 [ +0.000018] ? __warn+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000018] ? report_bug+0x24a/0x290 [ +0.000022] ? handle_bug+0x46/0x90 [ +0.000015] ? exc_invalid_op+0x19/0x50 [ +0.000016] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000017] ? kasan_save_stack+0x26/0x50 [ +0.000017] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000020] ? __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [ +0.000023] ? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __this_cpu_preempt_check+0x13/0x20 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? sysvec_apic_timer_interrupt+0x57/0xc0 [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.000022] ? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [d ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernelUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-extraUpgrade perfUpgrade kernel-rt-debug-coreUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-coreUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-headersUpgrade kernel-rt-develUpgrade kernel-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-coreUpgrade kernel-rt-coreUpgrade kernel-develUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-develUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modulesUpgrade kernel-debug-develUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modulesUpgrade kernel-doc | Jul 3, 2024 | Apr 2, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Apr 14, 2025 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-tools-libs | Jun 26, 2024 | Apr 2, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | Apr 2, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Jul 3, 2024 | Apr 2, 2024 |
| Rocky_linux | — | Upgrade kernel-tools-libsUpgrade kernel-develUpgrade kernel-rtUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-kvmUpgrade bpftool-debuginfoUpgrade kernel-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-modules-extraUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-cross-headersUpgrade kernel-rt-develUpgrade perfUpgrade kernelUpgrade kernel-rt-modulesUpgrade kernel-modulesUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-headersUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade bpftoolUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modules-extra | Jul 16, 2024 | Apr 2, 2024 |
| Suse | — | Upgrade kernel-azure-optionalUpgrade kernel-source-azureUpgrade kernel-rt_debug-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-allwinnerUpgrade dlm-kmp-rtUpgrade dtb-rockchipUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-develUpgrade kselftests-kmp-64kbUpgrade kernel-azure-extraUpgrade dtb-alteraUpgrade dtb-exynosUpgrade dtb-nvidiaUpgrade gfs2-kmp-azureUpgrade kernel-azureUpgrade kernel-develUpgrade kernel-default-baseUpgrade kernel-source-vanillaUpgrade dtb-amazonUpgrade dtb-caviumUpgrade dtb-renesasUpgrade reiserfs-kmp-defaultUpgrade dtb-freescaleUpgrade kernel-64kb-extraUpgrade kernel-debugUpgrade kernel-default-optionalUpgrade dlm-kmp-64kbUpgrade dtb-xilinxUpgrade kernel-default-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-rt-extraUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-livepatchUpgrade kernel-rt-optionalUpgrade kernel-default-livepatchUpgrade kernel-source-rtUpgrade gfs2-kmp-defaultUpgrade dtb-amdUpgrade dtb-broadcomUpgrade kernel-docs-htmlUpgrade kernel-debug-vdsoUpgrade kernel-default-develUpgrade cluster-md-kmp-rtUpgrade dtb-sprdUpgrade reiserfs-kmp-64kbUpgrade kernel-defaultUpgrade cluster-md-kmp-64kbUpgrade dtb-lgUpgrade kernel-debug-develUpgrade dtb-hisiliconUpgrade kernel-obs-buildUpgrade kernel-sourceUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade dlm-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-azure-develUpgrade gfs2-kmp-rtUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-vdsoUpgrade kselftests-kmp-rtUpgrade dtb-apmUpgrade kernel-rtUpgrade dtb-armUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-docsUpgrade kernel-default-extraUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-azureUpgrade kernel-kvmsmallUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-rt-livepatch-develUpgrade dtb-mediatekUpgrade dtb-appleUpgrade kernel-rt_debugUpgrade dtb-amlogicUpgrade kselftests-kmp-defaultUpgrade kernel-symsUpgrade kernel-obs-qaUpgrade kernel-devel-rtUpgrade kernel-syms-azureUpgrade kernel-64kb-livepatch-develUpgrade dtb-socionextUpgrade kernel-devel-azureUpgrade dtb-marvellUpgrade dtb-qcomUpgrade kernel-macrosUpgrade kernel-syms-rtUpgrade ocfs2-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-default-base-rebuildUpgrade kernel-debug-livepatch-develUpgrade kernel-64kb | May 15, 2024 | Apr 2, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-genericUpgrade linux-image-gkeUpgrade linux-image-raspiUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-azureUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-6.8.0-1006-oemUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-oracle-64kUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-ibm-classicUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-35-generic | Jul 1, 2024 | Apr 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub