In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix an illegal memory access
In the kfdwaitonevents() function, the kfdeventwaiter structure is allocated by alloceventwaiters(), but the event field of the waiter structure is not initialized; When copyfromuser() fails in the kfdwaitonevents() function, it will enter exception handling to release the previously allocated memory of the waiter structure; Due to the event field of the waiters structure being accessed in the free_waiters() function, this results in illegal memory access and system crash, here is the crash log:
localhost kernel: RIP: 0010:nativequeuedspinlockslowpath+0x185/0x1e0 localhost kernel: RSP: 0018:ffffaa53c362bd60 EFLAGS: 00010082 localhost kernel: RAX: ff3d3d6bff4007cb RBX: 0000000000000282 RCX: 00000000002c0000 localhost kernel: RDX: ffff9e855eeacb80 RSI: 000000000000279c RDI: ffffe7088f6a21d0 localhost kernel: RBP: ffffe7088f6a21d0 R08: 00000000002c0000 R09: ffffaa53c362be64 localhost kernel: R10: ffffaa53c362bbd8 R11: 0000000000000001 R12: 0000000000000002 localhost kernel: R13: ffff9e7ead15d600 R14: 0000000000000000 R15: ffff9e7ead15d698 localhost kernel: FS: 0000152a3d111700(0000) GS:ffff9e855ee80000(0000) knlGS:0000000000000000 localhost kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 localhost kernel: CR2: 0000152938000010 CR3: 000000044d7a4000 CR4: 00000000003506e0 localhost kernel: Call Trace: localhost kernel: rawspinlockirqsave+0x30/0x40 localhost kernel: removewaitqueue+0x12/0x50 localhost kernel: kfdwaitonevents+0x1b6/0x490 [hydcu] localhost kernel: ? ftracegraphcaller+0xa0/0xa0 localhost kernel: kfdioctl+0x38c/0x4a0 [hydcu] localhost kernel: ? kfdioctlsettraphandler+0x70/0x70 [hydcu] localhost kernel: ? kfdioctlcreatequeue+0x5a0/0x5a0 [hydcu] localhost kernel: ? ftracegraphcaller+0xa0/0xa0 localhost kernel: _x64sysioctl+0x8e/0xd0 localhost kernel: ? syscalltraceenter.isra.18+0x143/0x1b0 localhost kernel: dosyscall64+0x33/0x80 localhost kernel: entrySYSCALL64afterhwframe+0x44/0xa9 localhost kernel: RIP: 0033:0x152a4dff68d7
Allocate the structure with kcalloc, and remove redundant 0-initialization and a redundant loop condition check.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53090.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53090.json"
[
{
"id": "CVE-2023-53090-86c6952a",
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4fc8fff378b2f2039f2a666d9f8c570f4e58352c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"324316389604143574992445841133978083315",
"206037480767003634952603681495630171551",
"207838917780535376621033643787055191228",
"235008062426342350048620402082425635728",
"1327471930310683365811209510835066418",
"155365498493485705662780713092494396118",
"335947592517745921678123898827966241884",
"226957926686365018293517431091011255178",
"286585990165698314793403231727636603199",
"326783152883309609453708948951841604671",
"253122493909008935604338163431323926787",
"275160136658374434169874691887146270967"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53090-878ab81e",
"target": {
"function": "alloc_event_waiters",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4fc8fff378b2f2039f2a666d9f8c570f4e58352c",
"digest": {
"function_hash": "140742232339225042246309032768786229107",
"length": 296.0
},
"signature_type": "Function"
}
]