Null Return of kmalloc_array() in drm/amdkfd
Summary
GSD-2022-1002386: drm/amdkfd: Check for potential null return of kmalloc_array(). Affects Kernel versions < 40bf32dbfef866c83a3e74800b81d79e52b6d20b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/amdkfd package is a component of the Linux Kernel ecosystem. It provides support for AMD GPUs and is responsible for managing the Kernel Fusion Driver (KFD) for AMD GPUs. The package enables GPU compute functionality and facilitates communication between the GPU and the CPU. The vulnerability in question pertains to a potential null return of the kmalloc_array() function within the drm/amdkfd package.
Vulnerability Detail
The vulnerability arises from a lack of proper error handling in the kmalloc_array() function. If the function returns null due to memory allocation failure, subsequent operations relying on the allocated memory can lead to unexpected behavior, including crashes or privilege escalation. Attackers may exploit this vulnerability to execute arbitrary code or gain elevated privileges. The vulnerability has been addressed in Linux Kernel version v4.14.276 by commit 40bf32dbfef866c83a3e74800b81d79e52b6d20b.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in drm/amdkfd that allowed for a potential null return of the kmalloc_array() function has been addressed in Linux Kernel version v4.14.276. Users are advised to update their Linux Kernel to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially allow attackers to execute arbitrary code or gain elevated privileges on systems running the affected version of the Linux Kernel.
The exploitability of this vulnerability depends on various factors, including system configuration and network accessibility. However, remote exploitation is possible in certain scenarios.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
The recommended approach to mitigate this vulnerability is to update the Linux Kernel to the fixed version. However, implementing additional security measures, such as network segmentation and access controls, can help reduce the risk of exploitation.
More information about the fix can be found in the commit 40bf32dbfef866c83a3e74800b81d79e52b6d20b in the official Linux Kernel repository. Details about the vulnerability can be found in the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
