In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider the partial mapping offset. This can cause page fault access.
Fix the calculation of the starting and ending addresses, the total size is now deduced from the difference between the end and start addresses.
Additionally, the calculations have been rewritten in a clearer and more understandable form.
[Joonas: Add Requires: tag] Requires: 60a2066c5005 ("drm/i915/gem: Adjust vma offset for framebuffer mmap offset") (cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417)
[ { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b09513ce93b3dcb590baaaff2ce96f2d098312d", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "136266316771224693449090397929333174585", "235668483595918367152416347222642001655", "157731858179478054744118069991001159120", "10890590507548699688459235119261258696", "294912507728281297987170325139192167021", "261075453798374243936359827187391362781", "174822574084416403577032285054278294011", "309255270647739528157886515103506552702", "45642772257965536581871287319352381514", "119099637768898847881674719224485317001", "50709798542666651966405035088052516880", "237228713044609958890166425793245821117", "125115879963030929472806117877985434193", "55976036206086993127267940333258972948", "73904495689042825884018316672252714743", "193658789938537656275709244913766577861", "74213081296785340255557056942390343039", "119500197997020237437117826812996759903", "252978393452445929963345617514833230615", "205342819704415038842161001880284669225", "238504272775548918892703803161905757315" ] }, "id": "CVE-2024-42259-0cd3486c" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@911f8055f175c82775d0fd8cedcd0b75413f4ba7", "signature_version": "v1", "target": { "function": "vm_fault_gtt", "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "function_hash": "140490182896219110453135157799610259393", "length": 2706.0 }, "id": "CVE-2024-42259-1672025d" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b", "signature_version": "v1", "target": { "function": "vm_fault_gtt", "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "function_hash": "28360855189437678866521950268757646138", "length": 2970.0 }, "id": "CVE-2024-42259-17f834ae" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e06073d24807f04b4694108a8474decb7b99e60", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/i915/i915_gem.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "128241698407206657964627892373682749798", "284971524278103153945686078776022632391", "229410342640196748543300210105246487826", "312915069806069344564613845360602362876", "164060617003453672569020077103513279102", "262917820061440325036875280617345052088", "301355132045955091137537137892034820487", "75014223831207810641232902626898843211", "317315749073396549635803662822423195682", "55976036206086993127267940333258972948", "146973847682475941487095486877952584660", "96013424114526539184635063397771923913", "26349441984440187798334232074702436171", "40397931555041671560584327785329766229", "181994663520704802887512304372380259610", "205342819704415038842161001880284669225", "12249969395737804474682332143676075938" ] }, "id": "CVE-2024-42259-23e48311" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ead9289a51ea82eb5b27029fcf4c34b2dd60cf06", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "136266316771224693449090397929333174585", "235668483595918367152416347222642001655", "157731858179478054744118069991001159120", "10890590507548699688459235119261258696", "294912507728281297987170325139192167021", "261075453798374243936359827187391362781", "174822574084416403577032285054278294011", "309255270647739528157886515103506552702", "45642772257965536581871287319352381514", "119099637768898847881674719224485317001", "50709798542666651966405035088052516880", "237228713044609958890166425793245821117", "125115879963030929472806117877985434193", "55976036206086993127267940333258972948", "73904495689042825884018316672252714743", "193658789938537656275709244913766577861", "74213081296785340255557056942390343039", "119500197997020237437117826812996759903", "252978393452445929963345617514833230615", "205342819704415038842161001880284669225", "238504272775548918892703803161905757315" ] }, "id": "CVE-2024-42259-27573f46" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ead9289a51ea82eb5b27029fcf4c34b2dd60cf06", "signature_version": "v1", "target": { "function": "vm_fault_gtt", "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "function_hash": "328383343038752977268284276505563234769", "length": 2968.0 }, "id": "CVE-2024-42259-5177741d" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b09513ce93b3dcb590baaaff2ce96f2d098312d", "signature_version": "v1", "target": { "function": "vm_fault_gtt", "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "function_hash": "328383343038752977268284276505563234769", "length": 2968.0 }, "id": "CVE-2024-42259-52290494" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8a68aa842d3f8dd04a46b9d632e5f67fde1da9b", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "136266316771224693449090397929333174585", "235668483595918367152416347222642001655", "157731858179478054744118069991001159120", "10890590507548699688459235119261258696", "294912507728281297987170325139192167021", "261075453798374243936359827187391362781", "174822574084416403577032285054278294011", "309255270647739528157886515103506552702", "45642772257965536581871287319352381514", "119099637768898847881674719224485317001", "50709798542666651966405035088052516880", "237228713044609958890166425793245821117", "125115879963030929472806117877985434193", "55976036206086993127267940333258972948", "73904495689042825884018316672252714743", "50897783418925222500066986291465167259", "55933311471375796704610739196830792723", "49115537091828137172730342525963478133", "181994663520704802887512304372380259610", "205342819704415038842161001880284669225", "238504272775548918892703803161905757315" ] }, "id": "CVE-2024-42259-6371a753" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@911f8055f175c82775d0fd8cedcd0b75413f4ba7", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "136266316771224693449090397929333174585", "235668483595918367152416347222642001655", "157731858179478054744118069991001159120", "2047780070968252730573438833551407659", "249068099388834174387384163007055669403", "261075453798374243936359827187391362781", "174822574084416403577032285054278294011", "309255270647739528157886515103506552702", "45642772257965536581871287319352381514", "119099637768898847881674719224485317001", "50709798542666651966405035088052516880", "237228713044609958890166425793245821117", "125115879963030929472806117877985434193", "55976036206086993127267940333258972948", "146973847682475941487095486877952584660", "96013424114526539184635063397771923913", "26349441984440187798334232074702436171", "40397931555041671560584327785329766229", "181994663520704802887512304372380259610", "205342819704415038842161001880284669225", "238504272775548918892703803161905757315" ] }, "id": "CVE-2024-42259-67c36e7c" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50111a8098fb9ade621eeff82228a997d42732ab", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "171961704504629595462655305899815530302", "235668483595918367152416347222642001655", "157731858179478054744118069991001159120", "2047780070968252730573438833551407659", "249068099388834174387384163007055669403", "261075453798374243936359827187391362781", "174822574084416403577032285054278294011", "309255270647739528157886515103506552702", "45642772257965536581871287319352381514", "119099637768898847881674719224485317001", "50709798542666651966405035088052516880", "237228713044609958890166425793245821117", "125115879963030929472806117877985434193", "55976036206086993127267940333258972948", "146973847682475941487095486877952584660", "96013424114526539184635063397771923913", "26349441984440187798334232074702436171", "40397931555041671560584327785329766229", "181994663520704802887512304372380259610", "205342819704415038842161001880284669225", "238504272775548918892703803161905757315" ] }, "id": "CVE-2024-42259-73630621" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50111a8098fb9ade621eeff82228a997d42732ab", "signature_version": "v1", "target": { "function": "vm_fault_gtt", "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "function_hash": "140490182896219110453135157799610259393", "length": 2706.0 }, "id": "CVE-2024-42259-971f3334" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a256d019eaf044864c7e50312f0a65b323c24f39", "signature_version": "v1", "target": { "function": "i915_gem_fault", "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "function_hash": "142343309006861438319871044206333578225", "length": 2775.0 }, "id": "CVE-2024-42259-98330f59" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e06073d24807f04b4694108a8474decb7b99e60", "signature_version": "v1", "target": { "function": "i915_gem_fault", "file": "drivers/gpu/drm/i915/i915_gem.c" }, "digest": { "function_hash": "256399071941501811815351122289372677887", "length": 2530.0 }, "id": "CVE-2024-42259-9d8baf12" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "136266316771224693449090397929333174585", "235668483595918367152416347222642001655", "157731858179478054744118069991001159120", "10890590507548699688459235119261258696", "294912507728281297987170325139192167021", "261075453798374243936359827187391362781", "174822574084416403577032285054278294011", "309255270647739528157886515103506552702", "45642772257965536581871287319352381514", "119099637768898847881674719224485317001", "50709798542666651966405035088052516880", "237228713044609958890166425793245821117", "125115879963030929472806117877985434193", "55976036206086993127267940333258972948", "73904495689042825884018316672252714743", "193658789938537656275709244913766577861", "74213081296785340255557056942390343039", "119500197997020237437117826812996759903", "252978393452445929963345617514833230615", "205342819704415038842161001880284669225", "238504272775548918892703803161905757315" ] }, "id": "CVE-2024-42259-b5acd22a" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a256d019eaf044864c7e50312f0a65b323c24f39", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "128241698407206657964627892373682749798", "284971524278103153945686078776022632391", "229410342640196748543300210105246487826", "77775225416616068881324544941572172722", "81260757097787414011341317615362607873", "21580433545957994198599000943863552056", "280009588862601369078543011005329922339", "309255270647739528157886515103506552702", "45642772257965536581871287319352381514", "160018830803789101617996002446320182807", "55976036206086993127267940333258972948", "146973847682475941487095486877952584660", "96013424114526539184635063397771923913", "26349441984440187798334232074702436171", "40397931555041671560584327785329766229", "181994663520704802887512304372380259610", "205342819704415038842161001880284669225", "238504272775548918892703803161905757315" ] }, "id": "CVE-2024-42259-c3e920cf" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3", "signature_version": "v1", "target": { "function": "vm_fault_gtt", "file": "drivers/gpu/drm/i915/gem/i915_gem_mman.c" }, "digest": { "function_hash": "328383343038752977268284276505563234769", "length": 2968.0 }, "id": "CVE-2024-42259-d863fbc5" } ]