In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id
allocate_sdma_queue has an option where the sdma queue id can be
specified (used by CRIU). We weren't bounds-checking that
value.
Confirm it's less than the maximum number of queues.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 3
https://git.kernel.org/stable/c/42f2bd50236b61ad0aeb2c233c990ee0d615fdad
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/bfe9a7545b2a7be1c543f1741e16f2d5ec4116ae
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dd2870ca036e1d51baa59f942007b36a595b5890
416baaa9-dc9f-4396-8d5f-8c081fb06d67