Linux Kernel Integer Overflow Vulnerability in AMD KFD Debugger

An integer overflow vulnerability has been fixed in the Linux kernel's AMD KFD (Kernel Fusion Driver) debugger. The issue arose in the `get_queue_ids()` function, which calculated the size of an array based on the number of queues. This calculation could overflow on 32-bit systems, leading to potential memory corruption or other unintended behavior. The vulnerability has been addressed by using a safer method that prevents overflow by saturating the value to the maximum size allowed.

Impact

Exploitation of this vulnerability could lead to memory corruption or other unintended behaviors due to the integer overflow.

Reproduction

The vulnerability can be reproduced by building the Linux kernel with a 32-bit size_t, which allows the integer overflow to occur in the `get_queue_ids()` function of the AMD KFD debugger. This function multiplies the number of queues by the size of a uint32_t, which can exceed the maximum value representable in a 32-bit size_t, causing an overflow. The flawed calculation can be observed by passing a value that, when multiplied, exceeds the size limit, such as a high number of queues.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. The specific commit addressing this issue is available in the Linux kernel stable tree.