| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-42259: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| drm/i915/gem: Fix Virtual Memory mapping boundaries calculation |
| |
| Calculating the size of the mapped area as the lesser value |
| between the requested size and the actual size does not consider |
| the partial mapping offset. This can cause page fault access. |
| |
| Fix the calculation of the starting and ending addresses, the |
| total size is now deduced from the difference between the end and |
| start addresses. |
| |
| Additionally, the calculations have been rewritten in a clearer |
| and more understandable form. |
| |
| [Joonas: Add Requires: tag] |
| Requires: 60a2066c5005 ("drm/i915/gem: Adjust vma offset for framebuffer mmap offset") |
| (cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417) |
| |
| The Linux kernel CVE team has assigned CVE-2024-42259 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.9 with commit c58305af1835095ddc25ee6f548ac05915e66ac5 and fixed in 4.19.320 with commit 3e06073d24807f04b4694108a8474decb7b99e60 |
| Issue introduced in 4.9 with commit c58305af1835095ddc25ee6f548ac05915e66ac5 and fixed in 5.4.282 with commit a256d019eaf044864c7e50312f0a65b323c24f39 |
| Issue introduced in 4.9 with commit c58305af1835095ddc25ee6f548ac05915e66ac5 and fixed in 5.10.224 with commit 50111a8098fb9ade621eeff82228a997d42732ab |
| Issue introduced in 4.9 with commit c58305af1835095ddc25ee6f548ac05915e66ac5 and fixed in 5.15.165 with commit 911f8055f175c82775d0fd8cedcd0b75413f4ba7 |
| Issue introduced in 4.9 with commit c58305af1835095ddc25ee6f548ac05915e66ac5 and fixed in 6.1.106 with commit e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b |
| Issue introduced in 4.9 with commit c58305af1835095ddc25ee6f548ac05915e66ac5 and fixed in 6.6.46 with commit 4b09513ce93b3dcb590baaaff2ce96f2d098312d |
| Issue introduced in 4.9 with commit c58305af1835095ddc25ee6f548ac05915e66ac5 and fixed in 6.10.5 with commit ead9289a51ea82eb5b27029fcf4c34b2dd60cf06 |
| Issue introduced in 4.9 with commit c58305af1835095ddc25ee6f548ac05915e66ac5 and fixed in 6.11 with commit 8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-42259 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/gpu/drm/i915/gem/i915_gem_mman.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/3e06073d24807f04b4694108a8474decb7b99e60 |
| https://git.kernel.org/stable/c/a256d019eaf044864c7e50312f0a65b323c24f39 |
| https://git.kernel.org/stable/c/50111a8098fb9ade621eeff82228a997d42732ab |
| https://git.kernel.org/stable/c/911f8055f175c82775d0fd8cedcd0b75413f4ba7 |
| https://git.kernel.org/stable/c/e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b |
| https://git.kernel.org/stable/c/4b09513ce93b3dcb590baaaff2ce96f2d098312d |
| https://git.kernel.org/stable/c/ead9289a51ea82eb5b27029fcf4c34b2dd60cf06 |
| https://git.kernel.org/stable/c/8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3 |
| https://project-zero.issues.chromium.org/issues/42451707 |
