Executive brief
The Linux kernel's display driver for Qualcomm MSM GPUs fails to validate the number of display bridges before storing them in a fixed-size array. An attacker with local access could potentially add more than eight bridges, causing the code to write beyond the array bounds and corrupt adjacent kernel memory, leading to crashes or privilege escalation.
Technical details
The vulnerability is a classic buffer overflow in the DRM (Direct Rendering Manager) MSM HDMI driver's bridge initialization code. The root cause is a missing bounds check in the msm_hdmi_modeset_init() function, which allows the bridge counter (num_bridges) to exceed the fixed eight-element bridge array without validation. An attacker with local access and the ability to control device configuration or attach display bridges can trigger out-of-bounds memory writes. The fix adds a sanity check that returns -ENOSPC if the bridge array is full before attempting to add another bridge. The vulnerability affects Linux kernel versions from at least 3.12 through 5.x and later.
Affected products
- Linux Linux kernel 3.12 and later
Timeline
- 2022-09-13: disclosed: Patch authored by Johan Hovold
- 2022-11-03: patched: Stable kernel fix committed by Greg Kroah-Hartman