In the Linux kernel, the following vulnerability has been resolved:
drm/panfrost: Job should reference MMU not file_priv
For a while now it's been allowed for a MMU context to outlive it's corresponding panfrostpriv, however the job structure still references panfrostpriv to get hold of the MMU context. If panfrost_priv has been freed this is a use-after-free which I've been able to trigger resulting in a splat.
To fix this, drop the reference to panfrost_priv in the job structure and add a direct reference to the MMU structure which is what's actually needed.
[
{
"id": "CVE-2022-49359-01396a5c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.c",
"function": "panfrost_job_hw_submit"
},
"digest": {
"length": 1354.0,
"function_hash": "199353838205147328617569906790614021742"
},
"deprecated": false
},
{
"id": "CVE-2022-49359-0faab77c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c",
"function": "panfrost_ioctl_submit"
},
"digest": {
"length": 1304.0,
"function_hash": "218934588817131721025788090359683181725"
},
"deprecated": false
},
{
"id": "CVE-2022-49359-0fbb5a19",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"248836415885472396000619198015235016921",
"310249484868560016620956614658131206904",
"2442995889360106986540234724548197963",
"232738550884025785424167648644929806697",
"316209028956903021657980606080822450724",
"24874590130984593412044807699499139201",
"15577680844941849344864906448942326739",
"147250896308099023743026510670482439205",
"208044688449037214112255594690454103557",
"264286630153545815118690246979458286045",
"272304380641389850374544198532665990970"
]
},
"deprecated": false
},
{
"id": "CVE-2022-49359-1576b015",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.c",
"function": "panfrost_job_handle_done"
},
"digest": {
"length": 225.0,
"function_hash": "142807778308954391988485919804362936397"
},
"deprecated": false
},
{
"id": "CVE-2022-49359-245e06c0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.c",
"function": "panfrost_job_handle_err"
},
"digest": {
"length": 1293.0,
"function_hash": "117963291436483285797687692800834126296"
},
"deprecated": false
},
{
"id": "CVE-2022-49359-348e0935",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"306583361989027351022360401824198207046",
"329026527174189022055104917745430533506",
"17021032961320015117908072314091482118",
"139524272916451895466140881770042365210"
]
},
"deprecated": false
},
{
"id": "CVE-2022-49359-4a8f350f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"248836415885472396000619198015235016921",
"310249484868560016620956614658131206904",
"2442995889360106986540234724548197963",
"232738550884025785424167648644929806697",
"316209028956903021657980606080822450724",
"24874590130984593412044807699499139201",
"15577680844941849344864906448942326739",
"147250896308099023743026510670482439205",
"208044688449037214112255594690454103557",
"264286630153545815118690246979458286045",
"272304380641389850374544198532665990970"
]
},
"deprecated": false
},
{
"id": "CVE-2022-49359-4e192cb7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.c",
"function": "panfrost_job_hw_submit"
},
"digest": {
"length": 1354.0,
"function_hash": "199353838205147328617569906790614021742"
},
"deprecated": false
},
{
"id": "CVE-2022-49359-5254b444",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.c",
"function": "panfrost_job_handle_done"
},
"digest": {
"length": 225.0,
"function_hash": "142807778308954391988485919804362936397"
},
"deprecated": false
},
{
"id": "CVE-2022-49359-6c23cf1e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.c",
"function": "panfrost_job_handle_done"
},
"digest": {
"length": 225.0,
"function_hash": "142807778308954391988485919804362936397"
},
"deprecated": false
},
{
"id": "CVE-2022-49359-726498c8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"306583361989027351022360401824198207046",
"329026527174189022055104917745430533506",
"17021032961320015117908072314091482118",
"139524272916451895466140881770042365210"
]
},
"deprecated": false
},
{
"id": "CVE-2022-49359-91c3a9f6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"306583361989027351022360401824198207046",
"329026527174189022055104917745430533506",
"17021032961320015117908072314091482118",
"139524272916451895466140881770042365210"
]
},
"deprecated": false
},
{
"id": "CVE-2022-49359-9ef0d3d8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c",
"function": "panfrost_ioctl_submit"
},
"digest": {
"length": 1304.0,
"function_hash": "218934588817131721025788090359683181725"
},
"deprecated": false
},
{
"id": "CVE-2022-49359-a7fcea88",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"73146691979150245655526891826213907827",
"3019071414512483029001977019706983089",
"316704974291187931247407591619660397336",
"303385496453730305004471316972624120864",
"320227316112254312133568135358978800373",
"12802153883655746219270253444199967854",
"43145273952253776212963940435662321792",
"265971541378826603388103716760553552064",
"284120935072370516511381979823146252606",
"20887821156410485144977397092454972287",
"121294980593195236710894402194070574677",
"74863956660643148232067340770019882418"
]
},
"deprecated": false
},
{
"id": "CVE-2022-49359-c39884b1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"248836415885472396000619198015235016921",
"310249484868560016620956614658131206904",
"2442995889360106986540234724548197963",
"232738550884025785424167648644929806697",
"316209028956903021657980606080822450724",
"24874590130984593412044807699499139201",
"15577680844941849344864906448942326739",
"147250896308099023743026510670482439205",
"208044688449037214112255594690454103557",
"264286630153545815118690246979458286045",
"272304380641389850374544198532665990970"
]
},
"deprecated": false
},
{
"id": "CVE-2022-49359-d49cd75f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"73146691979150245655526891826213907827",
"3019071414512483029001977019706983089",
"316704974291187931247407591619660397336",
"303385496453730305004471316972624120864",
"320227316112254312133568135358978800373",
"12802153883655746219270253444199967854",
"43145273952253776212963940435662321792",
"265971541378826603388103716760553552064",
"284120935072370516511381979823146252606",
"20887821156410485144977397092454972287",
"121294980593195236710894402194070574677",
"74863956660643148232067340770019882418"
]
},
"deprecated": false
},
{
"id": "CVE-2022-49359-dacfec96",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.c",
"function": "panfrost_job_handle_err"
},
"digest": {
"length": 1293.0,
"function_hash": "117963291436483285797687692800834126296"
},
"deprecated": false
},
{
"id": "CVE-2022-49359-e3d47755",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.c",
"function": "panfrost_job_handle_err"
},
"digest": {
"length": 1293.0,
"function_hash": "117963291436483285797687692800834126296"
},
"deprecated": false
},
{
"id": "CVE-2022-49359-e57460bd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e516faf04317db2c46cbec4e3b78b4653a5b109",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.c",
"function": "panfrost_job_hw_submit"
},
"digest": {
"length": 1354.0,
"function_hash": "199353838205147328617569906790614021742"
},
"deprecated": false
},
{
"id": "CVE-2022-49359-ea971b79",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e8cc91a6ffc79865108279a74fd57d9070a17",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_job.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"73146691979150245655526891826213907827",
"3019071414512483029001977019706983089",
"316704974291187931247407591619660397336",
"303385496453730305004471316972624120864",
"320227316112254312133568135358978800373",
"12802153883655746219270253444199967854",
"43145273952253776212963940435662321792",
"265971541378826603388103716760553552064",
"284120935072370516511381979823146252606",
"20887821156410485144977397092454972287",
"121294980593195236710894402194070574677",
"74863956660643148232067340770019882418"
]
},
"deprecated": false
},
{
"id": "CVE-2022-49359-fcab3ad6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@472dd7ea5e19a1aeabf1711ddc756777e05ee7c2",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/panfrost/panfrost_drv.c",
"function": "panfrost_ioctl_submit"
},
"digest": {
"length": 1304.0,
"function_hash": "218934588817131721025788090359683181725"
},
"deprecated": false
}
]