Linux Kernel Radeon DRM Uninitialized Variable Vulnerability in VCE Command Stream Parsing

A vulnerability exists in the Linux kernel's Radeon Direct Rendering Manager (DRM) component, specifically within the video coding engine (VCE) command stream parsing function. The issue arises when the command stream, sent from userspace via an ioctl() call, is poorly crafted. In such cases, the function radeon_vce_cs_parse() may call radeon_vce_cs_reloc() with an uninitialized size argument. This occurs because the 'size' variable references 'tmp' before it has been assigned a value. The vulnerability has been addressed by initializing 'tmp' to zero, ensuring that radeon_vce_cs_reloc() can detect early errors in these scenarios.

Impact

Exploitation of this vulnerability could lead to undefined behavior in the kernel, potentially allowing for memory corruption or other unintended consequences.