Off-by-One Vulnerability in Linux Kernel's AMDGPU Driver
Summary
CVE-2022-49365: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq() The > ARRAY_SIZE() should be >= ARRAY_SIZE() to prevent an out of bounds access. Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system operations. The AMDGPU driver is responsible for managing AMD graphics cards, enabling high-performance graphics rendering and processing. This driver is crucial for systems that rely on AMD hardware for graphical tasks. However, it has been found to contain a vulnerability that can lead to out-of-bounds access, potentially compromising system stability and security.
Vulnerability Detail
The vulnerability identified as CVE-2022-49365 is an off-by-one error in the function dm_dmub_outbox1_low_irq() within the AMDGPU driver of the Linux kernel. This flaw arises from an incorrect use of the ARRAY_SIZE() macro, which should be greater than or equal to the actual size of the array being accessed. As a result, this can lead to out-of-bounds memory access, allowing an attacker to exploit the vulnerability to execute arbitrary code or cause a denial of service, thereby affecting system integrity and availability.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the patch by updating the package as described in the 'how_to_fix' section.
Conclusion
CVE-2022-49365 represents a significant vulnerability in the Linux kernel's AMDGPU driver, which can lead to serious security implications. It is essential for users to update their systems to the patched version to protect against potential exploits. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security measures.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49365 is a vulnerability in the Linux kernel's AMDGPU driver that allows for out-of-bounds memory access due to an off-by-one error.
This vulnerability can lead to system instability, potential arbitrary code execution, or denial of service, compromising the security of your system.
If you are using a version of the Linux kernel prior to 5.18.5-1, your system may be vulnerable. You can check your system's kernel version using the command 'uname -r'.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
While there are no specific workarounds, it is crucial to prioritize updating your kernel to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
