In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a use-after-free (write) in the i915ppgttclose function in drivers/gpu/drm/i915/i915gemgtt.c, aka CID-7dc40713618c. This is related to i915gemcontextdestroyioctl in drivers/gpu/drm/i915/i915gemcontext.c.
[
{
"target": {
"function": "i915_gem_context_open",
"file": "drivers/gpu/drm/i915/i915_gem_context.c"
},
"id": "CVE-2020-7053-139e5cfd",
"deprecated": false,
"digest": {
"length": 634.0,
"function_hash": "252760168277626910411224032831487476054"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@7dc40713618c884bf07c030d1ab1f47a9dc1f310",
"signature_version": "v1"
},
{
"target": {
"function": "gem_context_register",
"file": "drivers/gpu/drm/i915/i915_gem_context.c"
},
"id": "CVE-2020-7053-19d9df9a",
"deprecated": false,
"digest": {
"length": 656.0,
"function_hash": "225773383711048805274707497603078253950"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@7dc40713618c884bf07c030d1ab1f47a9dc1f310",
"signature_version": "v1"
},
{
"target": {
"function": "i915_gem_context_close",
"file": "drivers/gpu/drm/i915/i915_gem_context.c"
},
"id": "CVE-2020-7053-1cfeb436",
"deprecated": false,
"digest": {
"length": 229.0,
"function_hash": "135203275388782286274188918626647881345"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@7dc40713618c884bf07c030d1ab1f47a9dc1f310",
"signature_version": "v1"
},
{
"target": {
"file": "drivers/gpu/drm/i915/i915_gem_context.c"
},
"id": "CVE-2020-7053-3176e3b5",
"deprecated": false,
"digest": {
"line_hashes": [
"65075526612589083567387439031084157890",
"244700496607181348069260719880517489829",
"135393040380693100649443729107886045846",
"259092039318557051403172365375472742484",
"33091535802121881028895083395327035288",
"307188488007118735874247934418677887397",
"331246889672338326222619425981423674198",
"117891678899369392303351529991753554241",
"124786709591545542619305334309564560302",
"36671242295638453395996705124649504252",
"108095802107665270388902657123724692768",
"185186155271200572407797631607590155819",
"143284980402799516193152587126419539832",
"275137479101014182688981484837656688910",
"45943582893887211525704981865337274919",
"294940636038983689492990912182277990908",
"101336064785918044512314091475975811277",
"279441441233983353808475210608283760320",
"192824526391776485135216295166677352476",
"338964067690001067297808392483587533548",
"43437882662784467309069876404868614887",
"28635097870800395944770643146571793517",
"158820292538441742696876501233552954693",
"177343973666995456505584161501436511861",
"317694066844515133726701150857491154894",
"11784349672101078149201717368390044455",
"90424156486239962043282056707563489652",
"112950569355950730524075284000250333606",
"125056899409999518452280207273384603749",
"84457133561441117161974005719729443935",
"31853866600270571724394323893589784345",
"3604894165229535435675402769314169482",
"80677995933917618106511401384440894280",
"149740009901932552853365348526695081028",
"7331375638653261773843722947349014733",
"186429730365754022862569620436210355203",
"234877177467063542775282657577629020010",
"273217639953015381827151506456651275484",
"154715355821628692969659110588482747252",
"246097293627612630129203586132689697594",
"274812449033309708227673879298584202940",
"329879627580662280513573870260151801964",
"120833690828952462229966301958019732849",
"1141120528230527672634374721287128665",
"256712562564102709796784473568022598648",
"144606734643104156678488481645815116215",
"199624598878485067309875757063001864890",
"66489898583402818702227104477998665157",
"37759575011728383869435459207158321436",
"29194598936900532078616228492709346316",
"136774477914513004751358247351583830353",
"46807135470304910052646041796470887666",
"234554986383833240368903306342280101774",
"317724666059880073851539107123849806747",
"184394521977687319590778187372902675366",
"136828332866197068294724385790067146427",
"160926007800896344340400072467345372486",
"169518254965829737997550608776596304810",
"192952506731927781174521554907925501535",
"73875470352164157936853060797964923387",
"209496411972352578510835639525269250082",
"140359531816556868243854796452400651130",
"29713651542283650026478372617865504027",
"238130412534258663699743930600063122584",
"110599929073372905334530419035797924648",
"291160688695770453689741353749914485251",
"246657444314558719845756485153092093476"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@7dc40713618c884bf07c030d1ab1f47a9dc1f310",
"signature_version": "v1"
},
{
"target": {
"function": "i915_gem_context_create_ioctl",
"file": "drivers/gpu/drm/i915/i915_gem_context.c"
},
"id": "CVE-2020-7053-38c42459",
"deprecated": false,
"digest": {
"length": 957.0,
"function_hash": "301789530377493890881618275076921408671"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@7dc40713618c884bf07c030d1ab1f47a9dc1f310",
"signature_version": "v1"
},
{
"target": {
"function": "context_idr_cleanup",
"file": "drivers/gpu/drm/i915/i915_gem_context.c"
},
"id": "CVE-2020-7053-a5181d57",
"deprecated": false,
"digest": {
"length": 125.0,
"function_hash": "162120779609544241376541710723397230816"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@7dc40713618c884bf07c030d1ab1f47a9dc1f310",
"signature_version": "v1"
},
{
"target": {
"file": "drivers/gpu/drm/i915/i915_drv.h"
},
"id": "CVE-2020-7053-bbb0bdf2",
"deprecated": false,
"digest": {
"line_hashes": [
"332165430813503077727605174995294438994",
"328421301008510241649235402588473731699",
"327213574169570602669487491535689754786",
"55823700224146782205380434277297380380",
"111924862562979365954459174187112449160"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@7dc40713618c884bf07c030d1ab1f47a9dc1f310",
"signature_version": "v1"
},
{
"target": {
"function": "i915_gem_context_destroy_ioctl",
"file": "drivers/gpu/drm/i915/i915_gem_context.c"
},
"id": "CVE-2020-7053-cd13498d",
"deprecated": false,
"digest": {
"length": 549.0,
"function_hash": "38461072811633594806094735883097209580"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@7dc40713618c884bf07c030d1ab1f47a9dc1f310",
"signature_version": "v1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-7053.json"