Null Return of kmalloc_array() in drm/amdkfd
Summary
GSD-2022-1001956: drm/amdkfd: Check for potential null return of kmalloc_array(). Affects Kernel versions < 1d7a5aae884ca727d41c7ed15d4c82fdb67c040c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/amdkfd package is a component of the Linux Kernel that provides support for AMD GPUs in the kernel's Direct Rendering Manager (DRM) subsystem. It allows user-space applications to communicate with the AMD GPU hardware. The kmalloc_array() function is used in the package to allocate memory for an array of objects. However, there is a vulnerability in the package that fails to check for a potential null return of kmalloc_array().
Vulnerability Detail
The vulnerability in drm/amdkfd arises from the lack of proper error handling when allocating memory using kmalloc_array(). If the allocation fails and returns null, subsequent operations on the allocated memory can lead to undefined behavior, including crashes or potential security vulnerabilities. An attacker may be able to exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel.
Conclusion
The vulnerability in drm/amdkfd that fails to check for a potential null return of kmalloc_array() can lead to crashes or potential security vulnerabilities. It is recommended to update the Linux Kernel to version v5.10.112 or later to fix this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific use case and system configuration. It could potentially lead to crashes, privilege escalation, or other security vulnerabilities.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you if the vulnerability is present.
At the time of this report, there are no known public exploits for this vulnerability. However, it is always recommended to apply security patches promptly to mitigate potential risks.
This vulnerability requires local access to the system. It cannot be exploited remotely over a network.
For more details about this vulnerability, you can refer to the source link provided in the vulnerability details section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
