In the Linux kernel, the following vulnerability has been resolved:
drm/panfrost: Fix GEM handle creation ref-counting
panfrostgemcreatewithhandle() previously returned a BO but with the only reference being from the handle, which user space could in theory guess and release, causing a use-after-free. Additionally if the call to panfrostgemmappingget() in panfrostioctlcreatebo() failed then a(nother) reference on the BO was dropped.
The createwithhandle() is a problematic pattern, so ditch it and instead create the handle in panfrostioctlcreatebo(). If the call to panfrostgemmapping_get() fails then this means that user space has indeed gone behind our back and freed the handle. In which case just return an error code.
[
{
"id": "CVE-2022-50417-00a65a91",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_gem.c"
},
"digest": {
"line_hashes": [
"255685800235234328066378460051134521105",
"208549705275425032595984942021095840124",
"15894274156256269159865898844858798296",
"266134852778012361597067178212406911688",
"136426682712213712224458506447656954919",
"68878492447525705362365052374787564491",
"71735303546838284606038212032635084230",
"144941367857413115481179632283197309246",
"58556010305863385065865653356968056229",
"221965775537214398803381392138276874812",
"41095769528237294705973415549217471670",
"98532702579929414605005121082457861748",
"292724289441239240938369449361468100308",
"163405869517546316285964539778325403224",
"323520108676382403461034293586465460980",
"36959246363243419162855999762832143817"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4217c6ac817451d5116687f3cc6286220dc43d49"
},
{
"id": "CVE-2022-50417-10a65bcc",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_gem.h"
},
"digest": {
"line_hashes": [
"98868550985893939184040696654827246945",
"141838422018784490061016299091708990884",
"15894274156256269159865898844858798296",
"286724090974422026207208835965186441244",
"111306963779919401221256422763247181655",
"308659545195629633377154864095368370911",
"138587878001003017233799164374320196373"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2"
},
{
"id": "CVE-2022-50417-3f90e1a9",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"line_hashes": [
"30272218900047536884250496611202361945",
"166293172736555780274311288211877935103",
"180369710977074076768327330855592690428",
"147038521228172561224766928678288282297",
"269679640260053400224658014785221237871",
"168011727715527789068807539248278203974",
"167245769113982374060699257302558195887",
"150592092024428582961754836217492951376",
"181238920989031647461329336797891947757",
"239190894049827068608392775327495292576",
"235206657660862818917739971666975619941",
"113671991651984099709775352784594563635",
"297374807268858175662900581322796096167",
"84448866159930977325459129711785682125",
"64680772460323336414152415742476376661",
"26056981138565073641127303838548742990",
"8047001232376317525761530374883319933",
"208651935443549168476862437837390308371",
"235576848075753682788679603109974077036"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4217c6ac817451d5116687f3cc6286220dc43d49"
},
{
"id": "CVE-2022-50417-427af6c1",
"target": {
"function": "panfrost_gem_create_with_handle",
"file": "drivers/gpu/drm/panfrost/panfrost_gem.c"
},
"digest": {
"length": 562.0,
"function_hash": "84140922484523189129186282025995264447"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a"
},
{
"id": "CVE-2022-50417-515001b0",
"target": {
"function": "panfrost_gem_create_with_handle",
"file": "drivers/gpu/drm/panfrost/panfrost_gem.c"
},
"digest": {
"length": 562.0,
"function_hash": "84140922484523189129186282025995264447"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4217c6ac817451d5116687f3cc6286220dc43d49"
},
{
"id": "CVE-2022-50417-55e2e5b9",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_gem.h"
},
"digest": {
"line_hashes": [
"98868550985893939184040696654827246945",
"141838422018784490061016299091708990884",
"15894274156256269159865898844858798296",
"286724090974422026207208835965186441244",
"111306963779919401221256422763247181655",
"308659545195629633377154864095368370911",
"138587878001003017233799164374320196373"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba3d2c2380e7129b525a787489c0b7e819a3b898"
},
{
"id": "CVE-2022-50417-5d835f5b",
"target": {
"function": "panfrost_ioctl_create_bo",
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"length": 703.0,
"function_hash": "160167782150693792725920048898232747560"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2"
},
{
"id": "CVE-2022-50417-713ae521",
"target": {
"function": "panfrost_gem_create_with_handle",
"file": "drivers/gpu/drm/panfrost/panfrost_gem.c"
},
"digest": {
"length": 562.0,
"function_hash": "84140922484523189129186282025995264447"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c"
},
{
"id": "CVE-2022-50417-7d47a88b",
"target": {
"function": "panfrost_gem_create_with_handle",
"file": "drivers/gpu/drm/panfrost/panfrost_gem.c"
},
"digest": {
"length": 562.0,
"function_hash": "84140922484523189129186282025995264447"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba3d2c2380e7129b525a787489c0b7e819a3b898"
},
{
"id": "CVE-2022-50417-7f96e6aa",
"target": {
"function": "panfrost_gem_create_with_handle",
"file": "drivers/gpu/drm/panfrost/panfrost_gem.c"
},
"digest": {
"length": 562.0,
"function_hash": "84140922484523189129186282025995264447"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2"
},
{
"id": "CVE-2022-50417-8903f56d",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_gem.h"
},
"digest": {
"line_hashes": [
"98868550985893939184040696654827246945",
"141838422018784490061016299091708990884",
"15894274156256269159865898844858798296",
"286724090974422026207208835965186441244",
"111306963779919401221256422763247181655",
"308659545195629633377154864095368370911",
"138587878001003017233799164374320196373"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a"
},
{
"id": "CVE-2022-50417-8acaaadf",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"line_hashes": [
"30272218900047536884250496611202361945",
"166293172736555780274311288211877935103",
"180369710977074076768327330855592690428",
"147038521228172561224766928678288282297",
"269679640260053400224658014785221237871",
"168011727715527789068807539248278203974",
"167245769113982374060699257302558195887",
"150592092024428582961754836217492951376",
"181238920989031647461329336797891947757",
"239190894049827068608392775327495292576",
"235206657660862818917739971666975619941",
"113671991651984099709775352784594563635",
"297374807268858175662900581322796096167",
"84448866159930977325459129711785682125",
"64680772460323336414152415742476376661",
"26056981138565073641127303838548742990",
"8047001232376317525761530374883319933",
"208651935443549168476862437837390308371",
"235576848075753682788679603109974077036"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a"
},
{
"id": "CVE-2022-50417-a0a7f557",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_gem.c"
},
"digest": {
"line_hashes": [
"255685800235234328066378460051134521105",
"208549705275425032595984942021095840124",
"15894274156256269159865898844858798296",
"266134852778012361597067178212406911688",
"136426682712213712224458506447656954919",
"68878492447525705362365052374787564491",
"71735303546838284606038212032635084230",
"144941367857413115481179632283197309246",
"58556010305863385065865653356968056229",
"221965775537214398803381392138276874812",
"41095769528237294705973415549217471670",
"98532702579929414605005121082457861748",
"292724289441239240938369449361468100308",
"163405869517546316285964539778325403224",
"323520108676382403461034293586465460980",
"36959246363243419162855999762832143817"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a"
},
{
"id": "CVE-2022-50417-a0e52c7f",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_gem.c"
},
"digest": {
"line_hashes": [
"255685800235234328066378460051134521105",
"208549705275425032595984942021095840124",
"15894274156256269159865898844858798296",
"266134852778012361597067178212406911688",
"136426682712213712224458506447656954919",
"68878492447525705362365052374787564491",
"71735303546838284606038212032635084230",
"144941367857413115481179632283197309246",
"58556010305863385065865653356968056229",
"221965775537214398803381392138276874812",
"41095769528237294705973415549217471670",
"98532702579929414605005121082457861748",
"292724289441239240938369449361468100308",
"163405869517546316285964539778325403224",
"323520108676382403461034293586465460980",
"36959246363243419162855999762832143817"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba3d2c2380e7129b525a787489c0b7e819a3b898"
},
{
"id": "CVE-2022-50417-b2716372",
"target": {
"function": "panfrost_ioctl_create_bo",
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"length": 703.0,
"function_hash": "160167782150693792725920048898232747560"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c"
},
{
"id": "CVE-2022-50417-b3e03a99",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_gem.c"
},
"digest": {
"line_hashes": [
"255685800235234328066378460051134521105",
"208549705275425032595984942021095840124",
"15894274156256269159865898844858798296",
"266134852778012361597067178212406911688",
"136426682712213712224458506447656954919",
"68878492447525705362365052374787564491",
"71735303546838284606038212032635084230",
"144941367857413115481179632283197309246",
"58556010305863385065865653356968056229",
"221965775537214398803381392138276874812",
"41095769528237294705973415549217471670",
"98532702579929414605005121082457861748",
"292724289441239240938369449361468100308",
"163405869517546316285964539778325403224",
"323520108676382403461034293586465460980",
"36959246363243419162855999762832143817"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c"
},
{
"id": "CVE-2022-50417-c2ff0892",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_gem.c"
},
"digest": {
"line_hashes": [
"255685800235234328066378460051134521105",
"208549705275425032595984942021095840124",
"15894274156256269159865898844858798296",
"266134852778012361597067178212406911688",
"136426682712213712224458506447656954919",
"68878492447525705362365052374787564491",
"71735303546838284606038212032635084230",
"144941367857413115481179632283197309246",
"58556010305863385065865653356968056229",
"221965775537214398803381392138276874812",
"41095769528237294705973415549217471670",
"98532702579929414605005121082457861748",
"292724289441239240938369449361468100308",
"163405869517546316285964539778325403224",
"323520108676382403461034293586465460980",
"36959246363243419162855999762832143817"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2"
},
{
"id": "CVE-2022-50417-c9da3955",
"target": {
"function": "panfrost_ioctl_create_bo",
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"length": 703.0,
"function_hash": "160167782150693792725920048898232747560"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba3d2c2380e7129b525a787489c0b7e819a3b898"
},
{
"id": "CVE-2022-50417-cb6ba718",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"line_hashes": [
"30272218900047536884250496611202361945",
"166293172736555780274311288211877935103",
"180369710977074076768327330855592690428",
"147038521228172561224766928678288282297",
"269679640260053400224658014785221237871",
"168011727715527789068807539248278203974",
"167245769113982374060699257302558195887",
"150592092024428582961754836217492951376",
"181238920989031647461329336797891947757",
"239190894049827068608392775327495292576",
"235206657660862818917739971666975619941",
"113671991651984099709775352784594563635",
"297374807268858175662900581322796096167",
"84448866159930977325459129711785682125",
"64680772460323336414152415742476376661",
"26056981138565073641127303838548742990",
"8047001232376317525761530374883319933",
"208651935443549168476862437837390308371",
"235576848075753682788679603109974077036"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba3d2c2380e7129b525a787489c0b7e819a3b898"
},
{
"id": "CVE-2022-50417-d2c1c0fa",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"line_hashes": [
"30272218900047536884250496611202361945",
"166293172736555780274311288211877935103",
"180369710977074076768327330855592690428",
"147038521228172561224766928678288282297",
"269679640260053400224658014785221237871",
"168011727715527789068807539248278203974",
"167245769113982374060699257302558195887",
"150592092024428582961754836217492951376",
"181238920989031647461329336797891947757",
"239190894049827068608392775327495292576",
"235206657660862818917739971666975619941",
"113671991651984099709775352784594563635",
"297374807268858175662900581322796096167",
"84448866159930977325459129711785682125",
"64680772460323336414152415742476376661",
"26056981138565073641127303838548742990",
"8047001232376317525761530374883319933",
"208651935443549168476862437837390308371",
"235576848075753682788679603109974077036"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c"
},
{
"id": "CVE-2022-50417-d641a4ce",
"target": {
"function": "panfrost_ioctl_create_bo",
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"length": 703.0,
"function_hash": "160167782150693792725920048898232747560"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4217c6ac817451d5116687f3cc6286220dc43d49"
},
{
"id": "CVE-2022-50417-d70fac77",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"line_hashes": [
"30272218900047536884250496611202361945",
"166293172736555780274311288211877935103",
"180369710977074076768327330855592690428",
"147038521228172561224766928678288282297",
"269679640260053400224658014785221237871",
"168011727715527789068807539248278203974",
"167245769113982374060699257302558195887",
"150592092024428582961754836217492951376",
"181238920989031647461329336797891947757",
"239190894049827068608392775327495292576",
"235206657660862818917739971666975619941",
"113671991651984099709775352784594563635",
"297374807268858175662900581322796096167",
"84448866159930977325459129711785682125",
"64680772460323336414152415742476376661",
"26056981138565073641127303838548742990",
"8047001232376317525761530374883319933",
"208651935443549168476862437837390308371",
"235576848075753682788679603109974077036"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2"
},
{
"id": "CVE-2022-50417-e1d9bb0c",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_gem.h"
},
"digest": {
"line_hashes": [
"98868550985893939184040696654827246945",
"141838422018784490061016299091708990884",
"15894274156256269159865898844858798296",
"286724090974422026207208835965186441244",
"111306963779919401221256422763247181655",
"308659545195629633377154864095368370911",
"138587878001003017233799164374320196373"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c"
},
{
"id": "CVE-2022-50417-f5fe54a2",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_gem.h"
},
"digest": {
"line_hashes": [
"98868550985893939184040696654827246945",
"141838422018784490061016299091708990884",
"15894274156256269159865898844858798296",
"286724090974422026207208835965186441244",
"111306963779919401221256422763247181655",
"308659545195629633377154864095368370911",
"138587878001003017233799164374320196373"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4217c6ac817451d5116687f3cc6286220dc43d49"
},
{
"id": "CVE-2022-50417-fae29880",
"target": {
"function": "panfrost_ioctl_create_bo",
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"length": 703.0,
"function_hash": "160167782150693792725920048898232747560"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a"
}
]