Executive brief
A vulnerability in the Linux kernel's Intel graphics driver (i915) could allow a local user to crash the system. The issue stems from how the driver calculates memory boundaries when mapping video memory. An attacker with local access could exploit this to trigger a system-wide 'page fault' or crash, leading to a denial of service.
Technical details
A vulnerability exists in the drm/i915/gem component of the Linux kernel due to an incorrect calculation of Virtual Memory (VM) mapping boundaries. Specifically, the driver calculated the mapped area size as the lesser of the requested and actual sizes without accounting for partial mapping offsets. This flaw in i915_gem_fault and vm_fault_gtt can be triggered by a local user during memory mapping operations, leading to an out-of-bounds page fault. The fix involves a rewrite of the set_address_limits function to correctly deduce total size from the difference between calculated start and end addresses, ensuring partial offsets are properly handled. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel 4.9 to 4.19.319, 4.20 to 5.4.281, 5.5 to 5.10.223, 5.11 to 5.15.164, 5.16 to 6.1.105, 6.2 to 6.6.45, 6.7 to 6.10.4
Timeline
- 2024-08-02: other: Patch submitted by Andi Shyti
- 2024-08-14: disclosed: CVE published
- 2024-08-14: patched: First stable kernel fixes released
References
- https://git.kernel.org/stable/c/3e06073d24807f04b4694108a8474decb7b99e60
- https://git.kernel.org/stable/c/4b09513ce93b3dcb590baaaff2ce96f2d098312d
- https://git.kernel.org/stable/c/50111a8098fb9ade621eeff82228a997d42732ab
- https://git.kernel.org/stable/c/8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3
- https://git.kernel.org/stable/c/911f8055f175c82775d0fd8cedcd0b75413f4ba7
- https://git.kernel.org/stable/c/a256d019eaf044864c7e50312f0a65b323c24f39
- https://git.kernel.org/stable/c/e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b