CVE-2022-50527: drm/amdgpu: Fix size validation for non-exclusive domains (v4)
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix size validation for non-exclusive domains (v4)
Fix amdgpubovalidatesize() to check whether the TTM domain manager for the requested memory exists, else we get a kernel oops when dereferencing "man".
v2: Make the patch standalone, i.e. not dependent on local patches. v3: Preserve old behaviour and just check that the manager pointer is not NULL. v4: Complain if GTT domain requested and it is uninitialized--most likely a bug.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the practical impact if the flaw is triggered?
The null pointer dereference can cause a kernel oops, resulting in a high availability impact. The supplied CVSS vector indicates no confidentiality or integrity impact.
Under what condition is the affected path reached?
The issue occurs when amdgpu buffer-object size validation requests a memory domain whose TTM domain manager does not exist. An uninitialized GTT domain is specifically identified as a likely bug condition.