Linux Kernel TTM Object Purge Use-After-Free Vulnerability in Intel Graphics Driver

A use-after-free vulnerability has been identified in the Linux kernel's Intel graphics driver (drm/i915) within the memory management component for buffer objects (TTM). This issue affects several versions of the Linux kernel and can lead to a general protection fault, particularly under heavy use on affected hardware. The vulnerability arises because the TTM page vector container, which is crucial for managing memory pages of graphics objects, can be replaced while a pointer to the original container is still in use. This flaw allows for the potential dereference of a file pointer field of a TTM page vector container associated with an object being purged on eviction, creating a window for exploitation.

Impact

Exploitation of this vulnerability can cause a general protection fault, likely due to a non-canonical address dereference, disrupting system stability and potentially leading to a denial of service.

Reproduction

The vulnerability can be reproduced by using the affected Intel graphics driver (drm/i915) under heavy workload conditions, which can trigger the use-after-free scenario during the TTM object purge process. This can be done by manipulating graphics memory management functions that handle buffer object validation and eviction, particularly those related to the TTM shmem backend.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been addressed. Instructions for downloading the patched version are available on the official Linux kernel website.