Critical CCS Handling Vulnerability in Linux Kernel - CVE-2022-49963
Summary
CVE-2022-49963: In the Linux kernel, the following vulnerability has been resolved: drm/i915/ttm: fix CCS handling Crucible + recent Mesa seems to sometimes hit: GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER) And it looks like we can... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting system integrity and performance. CVE-2022-49963 specifically affects the Direct Rendering Manager (DRM) subsystem, particularly the i915 graphics driver, which is crucial for managing graphics processing units (GPUs) in Intel hardware.
Vulnerability Detail
CVE-2022-49963 is a vulnerability in the Linux kernel's DRM subsystem, specifically related to the handling of compressed color surfaces (CCS) in the i915 driver. The issue arises from improper handling of object sizes during memory migration, leading to potential overflows and incorrect memory copying for large objects. This can result in system instability, crashes, or unexpected behavior when dealing with graphics operations. The vulnerability is triggered when object sizes exceed certain thresholds, specifically 8MB and 64MB, causing assertions to fail and potentially exposing the system to further risks.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. However, users are advised to avoid using large object sizes in graphics operations until the patch is applied.
Conclusion
CVE-2022-49963 is a significant vulnerability affecting the Linux kernel's i915 graphics driver, with the potential to cause system instability and crashes. Users are strongly encouraged to update to the latest patched version to mitigate risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring code access.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49963 is a vulnerability in the Linux kernel's DRM subsystem that affects the handling of compressed color surfaces in the i915 graphics driver.
The vulnerability can lead to system instability, crashes, or unexpected behavior during graphics operations, especially with large object sizes.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Yes, a patch has been released in version 6.0.2-1 of the Linux kernel. Users should update to this version or later.
While no specific workarounds are available, it is advisable to avoid operations that involve large object sizes in graphics processing until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
