[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170120082438.GA28326@kroah.com>
Date: Fri, 20 Jan 2017 09:24:38 +0100
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Cc: 'Anarcheuz Fritz' <anarcheuz@...il.com>, cve-assign@...re.org
Subject: Re: CVE Request - Samsung Exynos GPU driver OOB read
On Fri, Jan 20, 2017 at 12:19:34AM +0800, idl3r wrote:
> Unfortunately, there is no official git for tracking from Samsung, so I
> can't give a pointer to the particular commit.
>
> The bug itself resides in
> <root>/drivers/gpu/arm/t7xx/r5p0/mali_kbase_core_linux.c of the src tree, in
> function kbase_dispatch which is the main ioctl dispatcher of the driver:
Ah, so this isn't upstream in the main kernel tree, thanks for letting
me know, that's what I was most concerned about.
Hopefully Samsung figures a way to push this change out to all of their
users... :)
> static mali_error kbase_dispatch(struct kbase_context *kctx, void * const
> args, u32 args_size)
> {
> ...
> /* setup complete, perform normal operation */
>
> switch (id) {
> ...
> case KBASE_FUNC_TMU_SKIP:
> {
> /* MALI_SEC_INTEGRATION */
> #ifdef CONFIG_SENSORS_SEC_THERMISTOR
> #ifdef CONFIG_USE_VSYNC_SKIP
> struct kbase_uk_tmu_skip *tskip = args;
> int thermistor = sec_therm_get_ap_temperature();
> u32 i, t_index = tskip->num_ratiometer;
>
> for (i = 0; i < tskip->num_ratiometer; i++)
> <== missing of boundary check
> if (thermistor >= tskip->temperature[i])
> t_index = i;
>
> tskip->temperature is a uint32 array of static size(10 elements) and
> tskip->num_ratiometer a uint32 which is user controlled. Since the boundary
> check is missing, OOB read may happen leading to possible memory corruption.
It's "user controlled" through the drm interface? Or something else?
Anyway, no need for more details, this was great, thank you very much
for the quick response.
gre k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
