Critical Vulnerability in Linux Kernel: Double Release of Compute PASID
Summary
CVE-2022-50303: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix double release compute pasid If kfd_process_device_init_vm returns failure after vm is converted to compute vm and vm->pasid set to comp... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It manages system resources and facilitates communication between hardware and software components. This vulnerability affects the Linux kernel versions in Debian distributions, specifically related to the amdkfd driver, which is responsible for managing GPU resources in AMD hardware. The vulnerability can lead to system instability and potential crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the amdkfd driver where a double release of the compute Process Address Space ID (PASID) can occur. This happens if the function kfd_process_device_init_vm fails after converting a virtual memory (VM) to a compute VM and setting the vm->pasid to the compute PASID. Consequently, the drm close file handler may release the compute PASID before the KFD process can destroy the worker that is supposed to release the same PASID, leading to a NULL pointer dereference and system warnings. This vulnerability can result in crashes and instability in systems utilizing AMD GPUs.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability aside from applying the patch. Users are advised to monitor their systems for any unusual behavior and apply the kernel update as soon as possible.
Conclusion
The identified vulnerability in the Linux kernel related to the amdkfd driver poses significant risks to system stability and performance. Users are strongly encouraged to update their systems to the patched version to mitigate these risks. Utilizing tools like Vulert can further enhance vulnerability management and awareness.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a double release of the compute PASID in the amdkfd driver of the Linux kernel, which can lead to system crashes.
The vulnerability affects the Linux kernel versions in Debian 11, 12, 13, and 14.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and plan to apply the kernel update as soon as possible.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software, providing an easy way to stay informed.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
