Linux Kernel AMD GPU GEM Operation Mapping Information Oversized Entry Count Vulnerability

A vulnerability in the Linux kernel's AMD GPU driver allows for memory allocation issues in the GEM_OP GET_MAPPING_INFO operation. The vulnerability arises because the driver does not properly validate the user-supplied entry count, leading to potential memory allocations that exceed system limits. This flaw can cause a kernel warning and, on systems configured to panic on warnings, a complete system crash. The issue has been addressed by implementing a size check to prevent excessive entry counts from causing harmful allocations.

Impact

Exploitation of this vulnerability can lead to a kernel panic, causing a system crash, particularly on systems configured to panic on warnings.

Reproduction

The vulnerability can be reproduced by invoking the GEM_OP GET_MAPPING_INFO operation with a num_entries value that is large enough to cause the subsequent memory allocation to exceed INT_MAX. This will trigger a warning in the kernel's memory allocation functions, leading to a panic on systems that are set to panic on such warnings.

Remediation

Users should update to the latest version of the Linux kernel where this vulnerability has been fixed.