In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix use-after-free bug
The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was reported by Joonkyo Jung <[email protected]>. For example the following code:
static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; int ret;
arg.addr = 0xffffffffffff0000; arg.size = 0x80000000; /*2 Gb*/ arg.flags = 0x7; ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg); }
Due to the address and size are not valid there is a failure in amdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert-> check_shl_overflow, but we even the amdgpu_hmm_register failure we still call amdgpu_hmm_unregister into amdgpu_gem_object_free which causes access to a bad address. The following stack is below when the issue is reproduced when Kazan is enabled:
[ +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340 [ +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246 [ +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b [ +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260 [ +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25 [ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000 [ +0.000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0 [ +0.000010] Call Trace: [ +0.000006] <TASK> [ +0.000007] ? show_regs+0x6a/0x80 [ +0.000018] ? __warn+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000018] ? report_bug+0x24a/0x290 [ +0.000022] ? handle_bug+0x46/0x90 [ +0.000015] ? exc_invalid_op+0x19/0x50 [ +0.000016] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000017] ? kasan_save_stack+0x26/0x50 [ +0.000017] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000020] ? __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [ +0.000023] ? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __this_cpu_preempt_check+0x13/0x20 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? sysvec_apic_timer_interrupt+0x57/0xc0 [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.000022] ? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [d ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdump-modulesUpgrade python3-perfUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-coreUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libs-develUpgrade kernelUpgrade kernel-toolsUpgrade kernel-cross-headersUpgrade perfUpgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-develUpgrade kernel-debugUpgrade kernel-coreUpgrade kernel-debug-modulesUpgrade kernel-develUpgrade kernel-docUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdumpUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-tools-libsUpgrade kernel-modules-extraUpgrade kernel-rt-coreUpgrade kernel-headersUpgrade kernel-rt-modulesUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-devel | Jul 3, 2024 | Apr 2, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Apr 14, 2025 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Jun 26, 2024 | Apr 2, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | Apr 2, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Jul 3, 2024 | Apr 2, 2024 |
| Rocky_linux | — | Upgrade kernel-rtUpgrade kernelUpgrade bpftoolUpgrade kernel-toolsUpgrade perfUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-extraUpgrade kernel-cross-headersUpgrade kernel-rt-debug-coreUpgrade python3-perfUpgrade kernel-tools-libs-develUpgrade kernel-rt-modulesUpgrade kernel-headersUpgrade kernel-modules-extraUpgrade kernel-debug-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-tools-libsUpgrade kernel-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade perf-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-debugUpgrade kernel-debug-modulesUpgrade bpftool-debuginfo | Jul 16, 2024 | Apr 2, 2024 |
| Suse | — | Upgrade kernel-devel-rtUpgrade kernel-obs-qaUpgrade kernel-symsUpgrade kselftests-kmp-defaultUpgrade kselftests-kmp-rtUpgrade dtb-qcomUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade dtb-socionextUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-develUpgrade kernel-macrosUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade kernel-default-base-rebuildUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-azureUpgrade kernel-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-default-extraUpgrade kernel-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-docsUpgrade kernel-syms-rtUpgrade kernel-rt_debugUpgrade dtb-apmUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-rtUpgrade dtb-amlogicUpgrade dtb-appleUpgrade dtb-mediatekUpgrade gfs2-kmp-64kbUpgrade dtb-marvellUpgrade cluster-md-kmp-azureUpgrade dtb-armUpgrade kernel-zfcpdumpUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-renesasUpgrade kselftests-kmp-64kbUpgrade kernel-defaultUpgrade kernel-debug-develUpgrade dtb-nvidiaUpgrade dtb-hisiliconUpgrade dtb-exynosUpgrade dtb-alteraUpgrade cluster-md-kmp-64kbUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade gfs2-kmp-azureUpgrade dtb-caviumUpgrade dtb-amazonUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-rt-develUpgrade kernel-develUpgrade kernel-default-optionalUpgrade kernel-azureUpgrade kernel-default-baseUpgrade kernel-default-livepatch-develUpgrade kernel-rt-livepatchUpgrade kernel-rt-extraUpgrade gfs2-kmp-defaultUpgrade kernel-default-vdsoUpgrade kernel-rt-optionalUpgrade dtb-amdUpgrade kernel-default-develUpgrade kernel-obs-buildUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-azureUpgrade dtb-broadcomUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-debug-vdsoUpgrade dtb-sprdUpgrade kernel-debugUpgrade kernel-64kb-extraUpgrade dtb-lgUpgrade dtb-freescaleUpgrade dlm-kmp-64kbUpgrade kernel-sourceUpgrade reiserfs-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade kernel-azure-extraUpgrade kernel-64kb-develUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade kernel-rt-vdsoUpgrade kernel-default-livepatchUpgrade dtb-xilinx | May 15, 2024 | Apr 2, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-24.04Upgrade linux-image-gkeUpgrade linux-image-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-raspiUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-generic-64kUpgrade linux-image-genericUpgrade linux-image-gcpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-6.8.0-1006-oemUpgrade linux-image-oem-24.04aUpgrade linux-image-virtualUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-awsUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1009-awsUpgrade linux-image-azureUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-kvmUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1008-azure-fde | Jul 1, 2024 | Apr 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub