Executive brief
The Intel i915 GPU driver in the Linux kernel contains a race condition in its performance monitoring configuration interface. An attacker with local access can craft timing attacks to cause a use-after-free condition, potentially leading to kernel crashes, data corruption, or arbitrary code execution on systems using Intel integrated graphics.
Technical details
A use-after-free vulnerability exists in the i915_perf_add_config_ioctl function within the DRM i915 driver. The vulnerability occurs due to improper lock management: the metrics_lock is released before the oa_config object is completely dereferenced, creating a race condition window where userspace can guess the configuration ID and trigger concurrent removal of the object. An attacker can trigger this race by calling the add and remove config ioctls concurrently, causing the code to dereference a freed object. The fix involves moving the mutex_unlock call to occur after all object dereferences are complete, and storing the object ID in a local variable to avoid dereferencing after unlock. This vulnerability affects Linux kernel versions 4.14 and later and has been patched in stable branches.
Affected products
- Linux Linux kernel v4.14+
Timeline
- 2023-03-28: disclosed
- 2023-04-13: patched