oss-security - Security sensitive bug in the i915 kernel driver (CVE-2022-4139)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <c9089e54-bc0d-773c-233e-d63980ad49d4@intel.com>
Date: Wed, 30 Nov 2022 11:22:16 +0100
From: Andrzej Hajda <andrzej.hajda@...el.com>
To: oss-security@...ts.openwall.com
Cc: Daniel Vetter <daniel@...ll.ch>, Dave Airlie <airlied@...il.com>,
 Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
 Jani Nikula <jani.nikula@...ux.intel.com>,
 Tvrtko Ursulin <tvrtko.ursulin@...ux.intel.com>,
 Linus Torvalds <torvalds@...ux-foundation.org>,
 Marian Rehak <mrehak@...hat.com>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 Vegard Nossum <vegard.nossum@...cle.com>
Subject: Security sensitive bug in the i915 kernel driver (CVE-2022-4139)

Hi all,

[This is a public disclosure of an issue reported 7 days ago to 
linux-distros@...openwall.org. CVE-2022-4139 has been assigned to the 
issue since.]

Incorrect GPU TLB flush code has been discovered in i915 kernel driver.
In some cases (Gen12 hardware with specific types of engine) the 
engine's TLB is not flushed at all.
Depending on whether the GPU is running behind an active IOMMU there are 
two possible scenarios which can happen, due to stale TLB mapping:
1. Without IOMMU - GPU can still access physical memory which could be 
already assigned by OS to different process.
2. With IOMMU - GPU can access any memory, if the malicious process is 
able to create/reuse necessary IOMMU mappings.

It is currently not known if specific memory could be targeted, but 
random memory corruption or data leaks are a known possibility.

All Intel integrated and discrete GPUs Gen12 are affected, including 
Tiger Lake, Rocket Lake, Alder Lake, DG1, Raptor Lake, DG2, Arctic 
Sound, Meteor Lake.
Fix has already been developed and consists of fixing the method of 
writing to specific registers.
I am attaching a set of back-ported patches which implement the fix for 
all affected stable branches (all since 5.4).

This vulnerability has similar impact as CVE-2022-0330[1].

I will try to follow Linux Security Process[2]. So I hope to send the 
fix for public mailing list after 7 days.

[1]:https://nvd.nist.gov/vuln/detail/cve-2022-0330
[2]:https://www.kernel.org/doc/html/latest/admin-guide/security-bugs.html

Regards
Andrzej

Download attachment "media-tlb.tar" of type "application/x-tar" (20480 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.