Null Return of kmalloc_array() in drm/amdkfd
Summary
GSD-2022-1002290: drm/amdkfd: Check for potential null return of kmalloc_array(). Affects Kernel versions < 94869bb0de69a812f70231b0eb480bb2f7ae73a6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/amdkfd package is a component of the Linux Kernel that provides support for AMD GPUs in a heterogeneous system architecture. It allows for the management and communication between the CPU and GPU. The vulnerability in question arises from a potential null return of the kmalloc_array() function, which is used for allocating memory in the kernel.
Vulnerability Detail
The vulnerability occurs when the kmalloc_array() function returns null, indicating a failure to allocate memory. This can lead to various issues, such as crashes or privilege escalation, depending on how the allocated memory is subsequently used. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability has been fixed in Linux Kernel version v4.19.239 by commit 94869bb0de69a812f70231b0eb480bb2f7ae73a6.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in drm/amdkfd that involves the potential null return of kmalloc_array() can have various impacts depending on the subsequent use of the allocated memory. It is recommended to update the Linux Kernel to version v4.19.239 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on how the allocated memory is used. It could potentially lead to crashes or privilege escalation.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time.
Yes, the vulnerability has been fixed in Linux Kernel version v4.19.239 by commit 94869bb0de69a812f70231b0eb480bb2f7ae73a6. It is recommended to update to this version or later.
The remote exploitability of this vulnerability has not been proven yet. However, it is always recommended to apply security patches as soon as they are available.
You can find more information about this vulnerability in the GSD-2022-1002290 entry of the GSD database maintained by the Cloud Security Alliance. The link to the entry is provided in the references section.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
