Executive brief
The Linux kernel's AMD GPU driver contains an integer overflow vulnerability in the command submission code path. When processing specially crafted GPU commands with large size values, the overflow causes memory allocation to fail silently, leading to uninitialized memory access that can cause system instability or information disclosure.
Technical details
The vulnerability is an integer overflow in the amdgpu_cs_pass1 function in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c. The `size` variable was declared as an unsigned int; when multiplied by sizeof(uint32_t), a size value of 0x40000000 or larger overflows, wrapping to zero. This causes subsequent memory operations to reference uninitialized kernel memory. The fix changes the variable type from unsigned int to size_t to prevent overflow. The vulnerability is reachable by unprivileged users who can submit GPU commands, and no special authentication is required.
Affected products
- Linux Linux kernel versions containing amdgpu driver prior to fix commit 87c2213e85bd81e4a9a4d0880c256568794ae388
Timeline
- 2025-10-22: disclosed
- 2023-04-21: patched: Fix committed upstream; backported to stable trees