In the Linux kernel, the following vulnerability has been resolved:
drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC
When prefetch region is DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC for a BO VMA,
the code used it as an index into region_to_mem_type[], causing an
out-of-bounds access since the value is -1.
Resolve the preferred location for BO VMAs directly: local VRAM on dGFX
(using the BO's tile placement) or system memory on iGPU.
Discovered using AI-assisted static analysis confirmed by Intel Product
Security.
v2:
-Fix null dereference
(cherry picked from commit d9a4906ac03be9f6ed3f3b45c56c866b867fd75b)
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 3
https://git.kernel.org/stable/c/7bc597ce74bab4153b2009c92eccf889e9d74044
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c4affa4e8bc8086b4d3e8d6cf1055a624f813d72
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d256dac008d1d9e6378aa1a5454e89a8292d174c
416baaa9-dc9f-4396-8d5f-8c081fb06d67