In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix an illegal memory access
In the kfdwaitonevents() function, the kfdeventwaiter structure is allocated by alloceventwaiters(), but the event field of the waiter structure is not initialized; When copyfromuser() fails in the kfdwaitonevents() function, it will enter exception handling to release the previously allocated memory of the waiter structure; Due to the event field of the waiters structure being accessed in the free_waiters() function, this results in illegal memory access and system crash, here is the crash log:
localhost kernel: RIP: 0010:nativequeuedspinlockslowpath+0x185/0x1e0 localhost kernel: RSP: 0018:ffffaa53c362bd60 EFLAGS: 00010082 localhost kernel: RAX: ff3d3d6bff4007cb RBX: 0000000000000282 RCX: 00000000002c0000 localhost kernel: RDX: ffff9e855eeacb80 RSI: 000000000000279c RDI: ffffe7088f6a21d0 localhost kernel: RBP: ffffe7088f6a21d0 R08: 00000000002c0000 R09: ffffaa53c362be64 localhost kernel: R10: ffffaa53c362bbd8 R11: 0000000000000001 R12: 0000000000000002 localhost kernel: R13: ffff9e7ead15d600 R14: 0000000000000000 R15: ffff9e7ead15d698 localhost kernel: FS: 0000152a3d111700(0000) GS:ffff9e855ee80000(0000) knlGS:0000000000000000 localhost kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 localhost kernel: CR2: 0000152938000010 CR3: 000000044d7a4000 CR4: 00000000003506e0 localhost kernel: Call Trace: localhost kernel: rawspinlockirqsave+0x30/0x40 localhost kernel: removewaitqueue+0x12/0x50 localhost kernel: kfdwaitonevents+0x1b6/0x490 [hydcu] localhost kernel: ? ftracegraphcaller+0xa0/0xa0 localhost kernel: kfdioctl+0x38c/0x4a0 [hydcu] localhost kernel: ? kfdioctlsettraphandler+0x70/0x70 [hydcu] localhost kernel: ? kfdioctlcreatequeue+0x5a0/0x5a0 [hydcu] localhost kernel: ? ftracegraphcaller+0xa0/0xa0 localhost kernel: _x64sysioctl+0x8e/0xd0 localhost kernel: ? syscalltraceenter.isra.18+0x143/0x1b0 localhost kernel: dosyscall64+0x33/0x80 localhost kernel: entrySYSCALL64afterhwframe+0x44/0xa9 localhost kernel: RIP: 0033:0x152a4dff68d7
Allocate the structure with kcalloc, and remove redundant 0-initialization and a redundant loop condition check.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53090.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53090.json"
[
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c",
"function": "alloc_event_waiters"
},
"id": "CVE-2023-53090-4cc45614",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61f306f8df0d5559659c5578cf6d95236bcdcb25",
"digest": {
"function_hash": "140742232339225042246309032768786229107",
"length": 296.0
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c",
"function": "alloc_event_waiters"
},
"id": "CVE-2023-53090-5c2fe831",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9923e7214a870b312bf61f6a89c7554d0966985",
"digest": {
"function_hash": "140742232339225042246309032768786229107",
"length": 296.0
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
},
"id": "CVE-2023-53090-685b3650",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9923e7214a870b312bf61f6a89c7554d0966985",
"digest": {
"line_hashes": [
"324316389604143574992445841133978083315",
"206037480767003634952603681495630171551",
"207838917780535376621033643787055191228",
"235008062426342350048620402082425635728",
"1327471930310683365811209510835066418",
"155365498493485705662780713092494396118",
"335947592517745921678123898827966241884",
"226957926686365018293517431091011255178",
"286585990165698314793403231727636603199",
"326783152883309609453708948951841604671",
"253122493909008935604338163431323926787",
"275160136658374434169874691887146270967"
],
"threshold": 0.9
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
},
"id": "CVE-2023-53090-6a4aa5aa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61f306f8df0d5559659c5578cf6d95236bcdcb25",
"digest": {
"line_hashes": [
"324316389604143574992445841133978083315",
"206037480767003634952603681495630171551",
"207838917780535376621033643787055191228",
"235008062426342350048620402082425635728",
"1327471930310683365811209510835066418",
"155365498493485705662780713092494396118",
"335947592517745921678123898827966241884",
"226957926686365018293517431091011255178",
"286585990165698314793403231727636603199",
"326783152883309609453708948951841604671",
"253122493909008935604338163431323926787",
"275160136658374434169874691887146270967"
],
"threshold": 0.9
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c",
"function": "alloc_event_waiters"
},
"id": "CVE-2023-53090-6af5c788",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fece63b55c5d74cd6f5de51159e2cde37e10555",
"digest": {
"function_hash": "140742232339225042246309032768786229107",
"length": 296.0
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c",
"function": "alloc_event_waiters"
},
"id": "CVE-2023-53090-836a9409",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a3fb3b745af0ce46ec2e0c8e507bae45b937334",
"digest": {
"function_hash": "140742232339225042246309032768786229107",
"length": 296.0
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
},
"id": "CVE-2023-53090-86c6952a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4fc8fff378b2f2039f2a666d9f8c570f4e58352c",
"digest": {
"line_hashes": [
"324316389604143574992445841133978083315",
"206037480767003634952603681495630171551",
"207838917780535376621033643787055191228",
"235008062426342350048620402082425635728",
"1327471930310683365811209510835066418",
"155365498493485705662780713092494396118",
"335947592517745921678123898827966241884",
"226957926686365018293517431091011255178",
"286585990165698314793403231727636603199",
"326783152883309609453708948951841604671",
"253122493909008935604338163431323926787",
"275160136658374434169874691887146270967"
],
"threshold": 0.9
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c",
"function": "alloc_event_waiters"
},
"id": "CVE-2023-53090-878ab81e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4fc8fff378b2f2039f2a666d9f8c570f4e58352c",
"digest": {
"function_hash": "140742232339225042246309032768786229107",
"length": 296.0
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
},
"id": "CVE-2023-53090-bc3ba8b9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fece63b55c5d74cd6f5de51159e2cde37e10555",
"digest": {
"line_hashes": [
"324316389604143574992445841133978083315",
"206037480767003634952603681495630171551",
"207838917780535376621033643787055191228",
"235008062426342350048620402082425635728",
"1327471930310683365811209510835066418",
"155365498493485705662780713092494396118",
"335947592517745921678123898827966241884",
"226957926686365018293517431091011255178",
"286585990165698314793403231727636603199",
"326783152883309609453708948951841604671",
"253122493909008935604338163431323926787",
"54765422241101408773331606405827803990"
],
"threshold": 0.9
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
},
"id": "CVE-2023-53090-c3c09eae",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a3fb3b745af0ce46ec2e0c8e507bae45b937334",
"digest": {
"line_hashes": [
"324316389604143574992445841133978083315",
"206037480767003634952603681495630171551",
"207838917780535376621033643787055191228",
"235008062426342350048620402082425635728",
"1327471930310683365811209510835066418",
"155365498493485705662780713092494396118",
"335947592517745921678123898827966241884",
"226957926686365018293517431091011255178",
"286585990165698314793403231727636603199",
"326783152883309609453708948951841604671",
"253122493909008935604338163431323926787",
"54765422241101408773331606405827803990"
],
"threshold": 0.9
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c",
"function": "alloc_event_waiters"
},
"id": "CVE-2023-53090-d3b4b799",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbf5eada4334a96e3a204b2307ff5b14dc380b0b",
"digest": {
"function_hash": "140742232339225042246309032768786229107",
"length": 296.0
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
},
"id": "CVE-2023-53090-d7881e3e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6936525142a015e854d0a23e9ad9ea0a28b3843d",
"digest": {
"line_hashes": [
"324316389604143574992445841133978083315",
"206037480767003634952603681495630171551",
"207838917780535376621033643787055191228",
"235008062426342350048620402082425635728",
"1327471930310683365811209510835066418",
"155365498493485705662780713092494396118",
"335947592517745921678123898827966241884",
"226957926686365018293517431091011255178",
"286585990165698314793403231727636603199",
"326783152883309609453708948951841604671",
"253122493909008935604338163431323926787",
"54765422241101408773331606405827803990"
],
"threshold": 0.9
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c",
"function": "alloc_event_waiters"
},
"id": "CVE-2023-53090-f85115be",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6936525142a015e854d0a23e9ad9ea0a28b3843d",
"digest": {
"function_hash": "140742232339225042246309032768786229107",
"length": 296.0
},
"deprecated": false
},
{
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
},
"id": "CVE-2023-53090-f99adf83",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbf5eada4334a96e3a204b2307ff5b14dc380b0b",
"digest": {
"line_hashes": [
"324316389604143574992445841133978083315",
"206037480767003634952603681495630171551",
"207838917780535376621033643787055191228",
"235008062426342350048620402082425635728",
"1327471930310683365811209510835066418",
"155365498493485705662780713092494396118",
"335947592517745921678123898827966241884",
"226957926686365018293517431091011255178",
"286585990165698314793403231727636603199",
"326783152883309609453708948951841604671",
"253122493909008935604338163431323926787",
"54765422241101408773331606405827803990"
],
"threshold": 0.9
},
"deprecated": false
}
]