Use-After-Free Vulnerability in Linux Kernel's AMDGPU Package
Summary
CVE-2022-50035: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix use-after-free on amdgpu_bo_list mutex If amdgpu_cs_vm_handling returns r != 0, then it will unlock the bo_list_mutex inside the functio... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The AMDGPU package is a driver for AMD graphics cards, enabling hardware acceleration and graphics rendering. This package is crucial for users relying on AMD GPUs for performance-intensive tasks such as gaming and graphic design. However, a recent vulnerability has been identified that could compromise system stability and security.
Vulnerability Detail
The vulnerability, identified as CVE-2022-50035, arises from a use-after-free condition in the AMDGPU driver. Specifically, if the function amdgpu_cs_vm_handling returns a non-zero value, it incorrectly unlocks the bo_list_mutex mutex in two different places. This can lead to a situation where memory that has already been freed is accessed again, resulting in potential system crashes or exploitation by malicious actors. The technical details indicate that this issue can trigger a refcount_t underflow, leading to warnings and possible system instability.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate risks.
Conclusion
The CVE-2022-50035 vulnerability in the Linux kernel's AMDGPU driver poses a significant risk to system stability and security. Users are strongly advised to update their systems to the patched version to mitigate potential threats. Regular monitoring of vulnerabilities is essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50035 is a vulnerability in the Linux kernel's AMDGPU driver that can lead to a use-after-free condition, potentially causing system instability.
If exploited, this vulnerability can lead to crashes or allow attackers to execute arbitrary code, compromising system security.
If you are using a version of the Linux kernel prior to 6.0.2-1, your system may be vulnerable. You can check your system's kernel version using the command 'uname -r'.
The best way to protect your system is to update the Linux kernel to the patched version 6.0.2-1 or later.
You can find detailed information about CVE-2022-50035 on the official CVE database or through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
