CVE-2024-26656: linux-libc-dev - kernel: drm/amdgpu: use-after-free vulnerability
Summary
CVE-2024-26656: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free bug The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an i... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Debian operating system that provides the C library headers for the Linux kernel. These headers are necessary for compiling and linking programs that use the Linux kernel API. The linux-libc-dev package is an essential component for software development on Debian-based systems. However, a use-after-free vulnerability has been discovered in the kernel's drm/amdgpu module, which can be exploited by an attacker to execute arbitrary code or cause a denial of service.
Vulnerability Detail
The use-after-free vulnerability in the drm/amdgpu module of the Linux kernel allows an attacker to trigger a use-after-free bug by sending a single amdgpu_gem_userptr_ioctl with an invalid address and size. This vulnerability can be exploited on any ASICs (Application-Specific Integrated Circuits) and can lead to a failure in amdgpu_hmm_register, resulting in access to a bad address. The vulnerability was reported by Joonkyo Jung and can be triggered by the following code:
static void Syzkaller1(int fd)
{
struct drm_amdgpu_gem_userptr arg;
int ret;
arg.addr = 0xffffffffffff0000;
arg.size = 0x80000000; /* 2 Gb */
arg.flags = 0x7;
ret = drmIoctl(fd, 0xc1186451 /* amdgpu_gem_userptr_ioctl */, &arg);
}
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment.
Conclusion
The linux-libc-dev package in Debian is vulnerable to a use-after-free vulnerability in the kernel's drm/amdgpu module. To mitigate this vulnerability, it is crucial to update the linux-libc-dev package to version 6.1.90-1 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Debian operating system that provides the C library headers for the Linux kernel. These headers are necessary for compiling and linking programs that use the Linux kernel API.
A use-after-free vulnerability occurs when a program continues to use a memory address after it has been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service.
This vulnerability can be exploited by sending a single amdgpu_gem_userptr_ioctl with an invalid address and size to the AMDGPU DRM driver on any ASICs. This triggers a use-after-free bug in the kernel's drm/amdgpu module.
This vulnerability was discovered by Joonkyo Jung joonkyoj@yonsei.ac.kr.
The CVSS score of this vulnerability is 4.7, indicating a medium severity.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
