| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49335: drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. |
| |
| Submitting a cs with 0 chunks, causes an oops later, found trying |
| to execute the wrong userspace driver. |
| |
| MESA_LOADER_DRIVER_OVERRIDE=v3d glxinfo |
| |
| [172536.665184] BUG: kernel NULL pointer dereference, address: 00000000000001d8 |
| [172536.665188] #PF: supervisor read access in kernel mode |
| [172536.665189] #PF: error_code(0x0000) - not-present page |
| [172536.665191] PGD 6712a0067 P4D 6712a0067 PUD 5af9ff067 PMD 0 |
| [172536.665195] Oops: 0000 [#1] SMP NOPTI |
| [172536.665197] CPU: 7 PID: 2769838 Comm: glxinfo Tainted: P O 5.10.81 #1-NixOS |
| [172536.665199] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CROSSHAIR V FORMULA-Z, BIOS 2201 03/23/2015 |
| [172536.665272] RIP: 0010:amdgpu_cs_ioctl+0x96/0x1ce0 [amdgpu] |
| [172536.665274] Code: 75 18 00 00 4c 8b b2 88 00 00 00 8b 46 08 48 89 54 24 68 49 89 f7 4c 89 5c 24 60 31 d2 4c 89 74 24 30 85 c0 0f 85 c0 01 00 00 <48> 83 ba d8 01 00 00 00 48 8b b4 24 90 00 00 00 74 16 48 8b 46 10 |
| [172536.665276] RSP: 0018:ffffb47c0e81bbe0 EFLAGS: 00010246 |
| [172536.665277] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 |
| [172536.665278] RDX: 0000000000000000 RSI: ffffb47c0e81be28 RDI: ffffb47c0e81bd68 |
| [172536.665279] RBP: ffff936524080010 R08: 0000000000000000 R09: ffffb47c0e81be38 |
| [172536.665281] R10: ffff936524080010 R11: ffff936524080000 R12: ffffb47c0e81bc40 |
| [172536.665282] R13: ffffb47c0e81be28 R14: ffff9367bc410000 R15: ffffb47c0e81be28 |
| [172536.665283] FS: 00007fe35e05d740(0000) GS:ffff936c1edc0000(0000) knlGS:0000000000000000 |
| [172536.665284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| [172536.665286] CR2: 00000000000001d8 CR3: 0000000532e46000 CR4: 00000000000406e0 |
| [172536.665287] Call Trace: |
| [172536.665322] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu] |
| [172536.665332] drm_ioctl_kernel+0xaa/0xf0 [drm] |
| [172536.665338] drm_ioctl+0x201/0x3b0 [drm] |
| [172536.665369] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu] |
| [172536.665372] ? selinux_file_ioctl+0x135/0x230 |
| [172536.665399] amdgpu_drm_ioctl+0x49/0x80 [amdgpu] |
| [172536.665403] __x64_sys_ioctl+0x83/0xb0 |
| [172536.665406] do_syscall_64+0x33/0x40 |
| [172536.665409] entry_SYSCALL_64_after_hwframe+0x44/0xa9 |
| |
| Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2018 |
| |
| The Linux kernel CVE team has assigned CVE-2022-49335 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 4.9.318 with commit 8189f44270db1be78169e11eec51a3eeb980bc63 |
| Fixed in 4.14.283 with commit aa25acbe96692e4bf8482311c293f72d8c6034c0 |
| Fixed in 4.19.247 with commit 15c3bcc9b5349d40207e5f8d4d799b8b4b7d13b8 |
| Fixed in 5.4.198 with commit c12984cdb077b9042d2dc20ca18cb16a87bcc774 |
| Fixed in 5.10.121 with commit be585921f29df5422a39c952d188b418ad48ffab |
| Fixed in 5.15.46 with commit 70276460e914d560e96bfc208695a872fe9469c9 |
| Fixed in 5.17.14 with commit 20b947e5a3c74c5084d661c097517a554989d462 |
| Fixed in 5.18.3 with commit 7086a23890d255bb5761604e39174b20d06231a4 |
| Fixed in 5.19 with commit 31ab27b14daaa75541a415c6794d6f3567fea44a |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49335 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/8189f44270db1be78169e11eec51a3eeb980bc63 |
| https://git.kernel.org/stable/c/aa25acbe96692e4bf8482311c293f72d8c6034c0 |
| https://git.kernel.org/stable/c/15c3bcc9b5349d40207e5f8d4d799b8b4b7d13b8 |
| https://git.kernel.org/stable/c/c12984cdb077b9042d2dc20ca18cb16a87bcc774 |
| https://git.kernel.org/stable/c/be585921f29df5422a39c952d188b418ad48ffab |
| https://git.kernel.org/stable/c/70276460e914d560e96bfc208695a872fe9469c9 |
| https://git.kernel.org/stable/c/20b947e5a3c74c5084d661c097517a554989d462 |
| https://git.kernel.org/stable/c/7086a23890d255bb5761604e39174b20d06231a4 |
| https://git.kernel.org/stable/c/31ab27b14daaa75541a415c6794d6f3567fea44a |
