138 lines
9.6 KiB
JSON
138 lines
9.6 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-53778",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-12-08T23:58:35.272Z",
|
|
"datePublished": "2025-12-09T00:00:34.074Z",
|
|
"dateUpdated": "2026-08-05T09:15:57.518Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T09:15:57.518Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Clean up integer overflow checking in map_user_pages()\n\nThe encode_dma() function has some validation on in_trans->size but it\nwould be more clear to move those checks to find_and_map_user_pages().\n\nThe encode_dma() had two checks:\n\n\tif (in_trans->addr + in_trans->size < in_trans->addr || !in_trans->size)\n\t\treturn -EINVAL;\n\nThe in_trans->addr variable is the starting address. The in_trans->size\nvariable is the total size of the transfer. The transfer can occur in\nparts and the resources->xferred_dma_size tracks how many bytes we have\nalready transferred.\n\nThis patch introduces a new variable \"remaining\" which represents the\namount we want to transfer (in_trans->size) minus the amount we have\nalready transferred (resources->xferred_dma_size).\n\nI have modified the check for if in_trans->size is zero to instead check\nif in_trans->size is less than resources->xferred_dma_size. If we have\nalready transferred more bytes than in_trans->size then there are negative\nbytes remaining which doesn't make sense. If there are zero bytes\nremaining to be copied, just return success.\n\nThe check in encode_dma() checked that \"addr + size\" could not overflow\nand barring a driver bug that should work, but it's easier to check if\nwe do this in parts. First check that \"in_trans->addr +\nresources->xferred_dma_size\" is safe. Then check that \"xfer_start_addr +\nremaining\" is safe.\n\nMy final concern was that we are dealing with u64 values but on 32bit\nsystems the kmalloc() function will truncate the sizes to 32 bits. So\nI calculated \"total = in_trans->size + offset_in_page(xfer_start_addr);\"\nand returned -EINVAL if it were >= SIZE_MAX. This will not affect 64bit\nsystems."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerability is reached only through the DRM_IOCTL_QAIC_MANAGE ioctl on the local accelerator character device /dev/accel/accelN; the malformed transaction list is copied in from local userspace via copy_from_user() in qaic_manage_ioctl(). No network or adjacent-network path exists.\nAC:L - The attacker fully controls addr, size and the number of DMA transactions in a single 4K manage message, and the arithmetic underflow/zero-page-count condition is deterministic — two page-aligned 4096-byte transfer transactions reliably drive need_pages to 0 on every attempt with no race or layout dependency.\nPR:L - The QAIC ioctls are registered with flags 0 (no DRM_ROOT_ONLY, no DRM_AUTH) and qaic_open() performs no capability check, so any unprivileged local user or container workload holding an open handle on the accel node — which systemd tags with uaccess and which inference stacks routinely expose to non-root service accounts — can trigger it.\nUI:N - The attacker issues the ioctl directly from their own process; no victim action, no file to be opened, and no privileged helper needs to be induced into doing anything.\nS:U - The corruption and the crash occur entirely within the kernel's own security authority on the host; the DMA mapping is DMA_TO_DEVICE over pages the attacker already owns, so no IOMMU, hypervisor, or sandbox boundary is crossed.\nC:H - The unchecked arithmetic makes the computed page count and the byte count handed to sg_alloc_table_from_pages()/dma_map_sgtable() diverge (need_pages is an unsigned long derived from u64 user input, and the sg API's size parameter is unsigned long, truncating on 32-bit), and the resulting wild ZERO_SIZE_PTR page-array dereference is an uncontrolled pointer read into DMA descriptor construction, which must be treated as an arbitrary-read-class exposure.\nI:H - The same page-count/byte-count mismatch feeds get_user_pages_fast() and the scatter-gather table that the device firmware consumes, so the descriptor set can be built from a page array sized by a different, overflowed value — an integer-overflow memory-safety condition of the class that yields out-of-bounds write primitives, which is precisely why the fix added check_add_overflow() and the SIZE_MAX guard.\nA:H - An unprivileged ioctl deterministically causes a near-NULL (0x10) pointer dereference and kernel oops inside sg_alloc_append_table_from_pages(), leaking two SRCU read sections so subsequent device reset/removal deadlocks, and the underflow variant pins and DMA-maps ~2 GB of memory per repeatable call, exhausting system memory."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/accel/qaic/qaic_control.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "129776ac2e38231fa9c02ce20e116c99de291666",
|
|
"lessThan": "d410a96e5cb8c1ec7049c83f2edcd8bbfaf5d9b3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "129776ac2e38231fa9c02ce20e116c99de291666",
|
|
"lessThan": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/accel/qaic/qaic_control.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.4",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.4",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.4.12",
|
|
"lessThanOrEqual": "6.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.5",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.4",
|
|
"versionEndExcluding": "6.4.12"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.4",
|
|
"versionEndExcluding": "6.5"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d410a96e5cb8c1ec7049c83f2edcd8bbfaf5d9b3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/96d3c1cadedb6ae2e8965e19cd12caa244afbd9c"
|
|
}
|
|
],
|
|
"title": "accel/qaic: Clean up integer overflow checking in map_user_pages()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |