196 lines
11 KiB
JSON
196 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-40172",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T07:20:57.177Z",
|
|
"datePublished": "2025-11-12T10:53:49.245Z",
|
|
"dateUpdated": "2026-08-05T12:08:17.861Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:08:17.861Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()\n\nCurrently, if find_and_map_user_pages() takes a DMA xfer request from the\nuser with a length field set to 0, or in a rare case, the host receives\nQAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size\nis equal to the requested transaction size, the function will return 0\nbefore allocating an sgt or setting the fields of the dma_xfer struct.\nIn that case, encode_addr_size_pairs() will try to access the sgt which\nwill lead to a general protection fault.\n\nReturn an EINVAL in case the user provides a zero-sized ALP, or the device\nrequests continuation after all of the bytes have been transferred."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The bug is reached only via the DRM_IOCTL_QAIC_MANAGE ioctl on the local accel character device /dev/accel/accelN, requiring local system access. There is no network-facing path into qaic_manage_ioctl().\nAC:L - A single ioctl carrying a QAIC_TRANS_DMA_XFER_FROM_USR transaction with the user-controlled size field set to 0 deterministically makes find_and_map_user_pages() return 0 with xfer->sgt/page_list/nr_pages uninitialized; no race and no attacker-independent condition is involved. Grooming the kmalloc-64 slab so the stale sgt is a usable pointer is fully under attacker control via a preceding legitimate DMA xfer.\nPR:L - The QAIC_MANAGE ioctl is registered with flags 0 — no DRM_ROOT_ONLY, no CAP_SYS_ADMIN, and no DRM_AUTH check — so any unprivileged process able to open the accel node (the normal case for inference/compute workloads and containers on AIC100 hosts) can trigger it. No capability is verified anywhere along encode_message() → encode_dma() → find_and_map_user_pages().\nUI:N - The attacker issues the ioctl directly from their own process; no victim action, mount, or file open is needed.\nS:U - The uninitialized-pointer use and resulting corruption occur within the kernel's own security authority, the same authority the attacker escalates into. No VM, IOMMU, or sandbox boundary is crossed as a required part of the impact.\nC:H - Using uninitialized heap memory as a struct sg_table pointer causes reads of arbitrary kernel memory via sgt->nents and the sg walk, and those harvested sg_dma_address/sg_dma_len values are encoded into the message sent to the accelerator, disclosing kernel-controlled DMA addresses off-host to the device. The resulting stale-pointer/double-free state is a general heap corruption primitive leveragable for arbitrary read.\nI:H - free_dma_xfers() unconditionally performs dma_unmap_sgtable(), sg_free_table(), kfree() on the uninitialized sgt and put_page()/kfree() over the uninitialized page_list and nr_pages, yielding arbitrary/double free and page refcount underflow on attacker-groomed pointers. Combined with feeding attacker-influenced addresses to the device's DMA engine, this is exploitable for arbitrary write and control-flow hijack.\nA:H - The commit itself documents that encode_addr_size_pairs() dereferences the unset sgt and produces a general protection fault, i.e. a kernel oops/panic, and it is triggerable repeatedly by any local user with device access. The double-free and page refcount corruption paths cause further fatal kernel faults."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/accel/qaic/qaic_control.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
|
|
"lessThan": "48b1d42286bfef7628b1d6c8c28d4e456c90f725",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
|
|
"lessThan": "551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
|
|
"lessThan": "1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
|
|
"lessThan": "11f08c30a3e4157305ba692f1d44cca5fc9a8fca",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d410a96e5cb8c1ec7049c83f2edcd8bbfaf5d9b3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "6.4.12",
|
|
"lessThan": "6.5",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/accel/qaic/qaic_control.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.5",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.5",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.114",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.55",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.17.5",
|
|
"lessThanOrEqual": "6.17.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "6.6.114"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "6.12.55"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "6.17.5"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "6.18"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.4.12"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/48b1d42286bfef7628b1d6c8c28d4e456c90f725"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/11f08c30a3e4157305ba692f1d44cca5fc9a8fca"
|
|
}
|
|
],
|
|
"title": "accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |