CVE-2022-50390: drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED
In the Linux kernel, the following vulnerability has been resolved:
drm/ttm: fix undefined behavior in bit shift for TTMTTFLAGPRIVPOPULATED
Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below:
UBSAN: shift-out-of-bounds in ./include/drm/ttm/ttmtt.h:122:26 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dumpstacklvl+0x7d/0xa5 dumpstack+0x15/0x1b ubsanepilogue+0xe/0x4e ubsanhandleshiftoutofbounds+0x1e7/0x20c ttmbomovememcpy+0x3b4/0x460 [ttm] bodrivermove+0x32/0x40 [drmvramhelper] ttmbohandlemovemem+0x118/0x200 [ttm] ttmbovalidate+0xfa/0x220 [ttm] drmgemvrampinlocked+0x70/0x1b0 [drmvramhelper] drmgemvrampin+0x48/0xb0 [drmvramhelper] drmgemvramplanehelperpreparefb+0x53/0xe0 [drmvramhelper] drmgemvramsimpledisplaypipepreparefb+0x26/0x30 [drmvramhelper] drmsimplekmsplanepreparefb+0x4d/0xe0 [drmkmshelper] drmatomichelperprepareplanes+0xda/0x210 [drmkmshelper] drmatomichelpercommit+0xc3/0x1e0 [drmkmshelper] drmatomiccommit+0x9c/0x160 [drm] drmclientmodesetcommitatomic+0x33a/0x380 [drm] drmclientmodesetcommitlocked+0x77/0x220 [drm] drmclientmodesetcommit+0x31/0x60 [drm] drmfbhelperrestorefbdevmodeunlocked+0xa7/0x170 [drmkmshelper] drmfbhelpersetpar+0x51/0x90 [drmkmshelper] fbconinit+0x316/0x790 visualinit+0x113/0x1d0 dobindcondriver+0x2a3/0x5c0 dotakeoverconsole+0xa9/0x270 dofbcontakeover+0xa1/0x170 dofbregistered+0x2a8/0x340 fbconfbregistered+0x47/0xe0 registerframebuffer+0x294/0x4a0 drmfbhelperinitialconfigandunlock+0x43c/0x880 [drmkmshelper] drmfbhelperinitialconfig+0x52/0x80 [drmkmshelper] drmfbdevclienthotplug+0x156/0x1b0 [drmkmshelper] drmfbdevgenericsetup+0xfc/0x290 [drmkmshelper] bochspciprobe+0x6ca/0x772 [bochs] localpciprobe+0x4d/0xb0 pcideviceprobe+0x119/0x320 reallyprobe+0x181/0x550 driverprobedevice+0xc6/0x220 driverprobedevice+0x32/0x100 driverattach+0x195/0x200 busforeachdev+0xbb/0x120 driverattach+0x27/0x30 busadddriver+0x22e/0x2f0 driverregister+0xa9/0x190 pciregisterdriver+0x90/0xa0 bochspcidriverinit+0x52/0x1000 [bochs] dooneinitcall+0x76/0x430 doinitmodule+0x61/0x28a loadmodule+0x1f82/0x2e50 dosysfinitmodule+0xf8/0x190 x64sysfinitmodule+0x23/0x30 dosyscall64+0x58/0x80 entrySYSCALL64afterhwframe+0x63/0xcd </TASK>
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50390?
CVE-2022-50390 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2022-50390?
To fix CVE-2022-50390, ensure that you update your Linux kernel to the latest patched version provided by your distribution.
What are the potential impacts of CVE-2022-50390?
The potential impacts of CVE-2022-50390 include undefined behavior in the graphics driver which could lead to system instability.
Which versions of the Linux kernel are affected by CVE-2022-50390?
CVE-2022-50390 affects multiple versions of the Linux kernel prior to the patch that rectified the bit shift issue.
Is CVE-2022-50390 actively being exploited?
As of now, there is no public knowledge of CVE-2022-50390 being actively exploited in the wild.