CVE-2024-26656

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix use-after-free bug

The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl

to the AMDGPU DRM driver on any ASICs with an invalid address and size.

The bug was reported by Joonkyo Jung <[email protected]>.

For example the following code:

static void Syzkaller1(int fd)

{

struct drm_amdgpu_gem_userptr arg;

int ret;

arg.addr = 0xffffffffffff0000;

arg.size = 0x80000000; /*2 Gb*/

arg.flags = 0x7;

ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg);

}

Due to the address and size are not valid there is a failure in

amdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert->

check_shl_overflow, but we even the amdgpu_hmm_register failure we still call

amdgpu_hmm_unregister into amdgpu_gem_object_free which causes access to a bad address.

The following stack is below when the issue is reproduced when Kazan is enabled:

[ +0.000014] Hardware name:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References