Linux Kernel QAIC Overflow Vulnerability in Memory Mapping

A vulnerability in the Linux kernel's QAIC (Qualcomm AI Compiler) component allows for improper memory mapping, potentially leading to use-after-free issues. This occurs in the 'qaic_gem_object_mmap' function, where the 'remap_pfn_range' call can map memory beyond the allocated virtual memory area (VMA) if the buffer object (BO) is too large. The issue arises because 'munmap()' only removes the VMA region, leaving additional mappings intact. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability can lead to use-after-free conditions, where memory that has been freed is still accessed, potentially causing memory corruption or allowing for arbitrary code execution.

Reproduction

To reproduce this vulnerability, create a buffer object that exceeds the available virtual memory area. When the 'qaic_gem_object_mmap' function is called, the 'remap_pfn_range' will improperly map the buffer, bypassing the VMA limits. After the mapping, use 'munmap()' to unmap the VMA region, which will not remove the additional, improperly mapped areas, creating a use-after-free situation.

Remediation

Users should update to the latest version of the Linux kernel where this vulnerability has been addressed.