CVE-2024-41011 drm/amdkfd: don't allow mapping the MMIO HDP page with large pages

2024-07-1807:04:04

Linux

www.cve.org

linux kernel

vulnerability

resolution

drm/amdkfd

mmio

hdp

large pages

EPSS

Percentile

5.1%

JSON

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: don’t allow mapping the MMIO HDP page with large pages

We don’t get the right offset in that case. The GPU has
an unused 4K area of the register BAR space into which you can
remap registers. We remap the HDP flush registers into this
space to allow userspace (CPU or GPU) to flush the HDP when it
updates VRAM. However, on systems with >4K pages, we end up
exposing PAGE_SIZE of MMIO space.

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/gpu/drm/amd/amdkfd/kfd_chardev.c"
    ],
    "versions": [
      {
        "version": "d8e408a82704",
        "lessThan": "009c4d78bcf0",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d8e408a82704",
        "lessThan": "f7276cdc1912",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d8e408a82704",
        "lessThan": "8ad4838040e5",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d8e408a82704",
        "lessThan": "89fffbdf535c",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d8e408a82704",
        "lessThan": "4b4cff994a27",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d8e408a82704",
        "lessThan": "6186c9356088",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d8e408a82704",
        "lessThan": "be4a2a81b6b9",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/gpu/drm/amd/amdkfd/kfd_chardev.c"
    ],
    "versions": [
      {
        "version": "5.3",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "5.3",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.4.283",
        "lessThanOrEqual": "5.4.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.10.225",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.15.166",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.91",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.31",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.8.10",
        "lessThanOrEqual": "6.8.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.9",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]