Boundary check missing in vm_access in drm/i915/gem
Summary
GSD-2022-1002121: drm/i915/gem: add missing boundary check in vm_access. Affects Kernel versions >= 9f909e215fea0652023b9ed09d3d7bfe10386423, < 89ddcc81914ab58cc203acc844f27d55ada8ec0e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/i915/gem package is a component of the Linux Kernel that provides support for Intel integrated graphics devices. It includes the Direct Rendering Manager (DRM) driver for the Intel Graphics Media Accelerator (GMA) series of GPUs. The vm_access function in this package is responsible for managing access to the graphics memory. However, a vulnerability has been discovered in this function that allows for a missing boundary check, potentially leading to security issues.
Vulnerability Detail
The vulnerability in drm/i915/gem is due to a missing boundary check in the vm_access function. This could allow an attacker to access memory beyond the intended boundaries, leading to potential security exploits. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.10.110 by commit 89ddcc81914ab58cc203acc844f27d55ada8ec0e. The vulnerability was introduced in version v5.8 by commit 9f909e215fea0652023b9ed09d3d7bfe10386423.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the drm/i915/gem package in the Linux Kernel is vulnerable to a missing boundary check in the vm_access function. This vulnerability could potentially lead to security issues and unauthorized access to sensitive information. It is crucial to update the Linux Kernel to version v5.10.110 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, if exploited, it could potentially lead to security issues and unauthorized access to sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
There is currently no known exploit for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
Yes, you can manually patch the vulnerability by updating the Linux Kernel to version v5.10.110 or later. However, it is recommended to follow the official installation instructions provided by the Linux Kernel developers to ensure a proper and secure update.
You can find more information about this vulnerability in the GSD-2022-1002121.json file available in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002121.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
