180 lines
12 KiB
JSON
180 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-68184",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-12-16T13:41:40.252Z",
|
|
"datePublished": "2025-12-16T13:43:02.010Z",
|
|
"dateUpdated": "2026-08-05T12:10:07.452Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:10:07.452Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Disable AFBC support on Mediatek DRM driver\n\nCommit c410fa9b07c3 (\"drm/mediatek: Add AFBC support to Mediatek DRM\ndriver\") added AFBC support to Mediatek DRM and enabled the\n32x8/split/sparse modifier.\n\nHowever, this is currently broken on Mediatek MT8188 (Genio 700 EVK\nplatform); tested using upstream Kernel and Mesa (v25.2.1), AFBC is used by\ndefault since Mesa v25.0.\n\nKernel trace reports vblank timeouts constantly, and the render is garbled:\n\n```\n[CRTC:62:crtc-0] vblank wait timed out\nWARNING: CPU: 7 PID: 70 at drivers/gpu/drm/drm_atomic_helper.c:1835 drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\n[...]\nHardware name: MediaTek Genio-700 EVK (DT)\nWorkqueue: events_unbound commit_work\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\nlr : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\nsp : ffff80008337bca0\nx29: ffff80008337bcd0 x28: 0000000000000061 x27: 0000000000000000\nx26: 0000000000000001 x25: 0000000000000000 x24: ffff0000c9dcc000\nx23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c66f2f80\nx20: ffff0000c0d7d880 x19: 0000000000000000 x18: 000000000000000a\nx17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000\nx14: 0000000000000000 x13: 74756f2064656d69 x12: 742074696177206b\nx11: 0000000000000058 x10: 0000000000000018 x9 : ffff800082396a70\nx8 : 0000000000057fa8 x7 : 0000000000000cce x6 : ffff8000823eea70\nx5 : ffff0001fef5f408 x4 : ffff80017ccee000 x3 : ffff0000c12cb480\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c12cb480\nCall trace:\n drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c (P)\n drm_atomic_helper_commit_tail_rpm+0x64/0x80\n commit_tail+0xa4/0x1a4\n commit_work+0x14/0x20\n process_one_work+0x150/0x290\n worker_thread+0x2d0/0x3ec\n kthread+0x12c/0x210\n ret_from_fork+0x10/0x20\n---[ end trace 0000000000000000 ]---\n```\n\nUntil this gets fixed upstream, disable AFBC support on this platform, as\nit's currently broken with upstream Mesa."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
|
|
"baseScore": 7.1,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - Exploitation requires local access to the DRM device node (/dev/dri/card*) to create an AFBC framebuffer with DRM_IOCTL_MODE_ADDFB2 and commit it with DRM_IOCTL_MODE_ATOMIC/SETPLANE/PAGE_FLIP. There is no network or remote path into the MediaTek display pipeline.\nAC:L - On affected MT8188/MT8195-class hardware the failure is fully deterministic — the commit message reports vblank timeouts \"constantly\" — and the attacker supplies the AFBC modifier and framebuffer dimensions themselves. No race, no unpredictable memory layout, and no condition outside the attacker's control is involved.\nPR:L - An unprivileged local user in the graphical session (or any user able to open the card node and become DRM master when none is held) can perform the ADDFB2 + atomic commit; no root or CAP_SYS_ADMIN is needed. In practice Mesa >= 25.0 selects AFBC by default, so an ordinary unprivileged GL/compositor client reaches the broken path with no special effort.\nUI:N - The attacker issues the framebuffer-creation and atomic-commit ioctls directly from their own process. No victim action, file open, or mount is required.\nS:U - The corruption and the hang are confined to the kernel's own security authority — the DRM/display driver and the memory it DMAs from. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The driver uses plain drm_gem_fb_create() and never calls drm_gem_fb_afbc_init(), so only the linear min_size in drm_gem_fb_init_with_funcs() is validated while the OVL is programmed for the larger AFBC layout — an out-of-bounds DMA read of roughly w*h/16 bytes (~127 KB at 1080p) past the GEM object. Compounding this, the timed-out vblank wait lets drm_atomic_helper_cleanup_planes() release the buffer while the engine is still scanning it, so freed and reallocated kernel memory is decoded and rendered to the display.\nI:N - The AFBC path only programs the overlay engine to read from the framebuffer; there is no out-of-bounds or use-after-free write, and no kernel data structure is modified by the attacker. The observed garbled output is a consequence of the faulty reads, not of any memory corruption.\nA:H - Every AFBC commit stalls the events_unbound commit worker for the full 1000 ms wait_event_timeout in drm_atomic_helper_wait_for_vblanks() and triggers a WARN(), which is an immediate kernel panic on panic_on_warn systems and a repeating splat flood otherwise. The display pipeline is left effectively hung with garbled output, and the buffer is freed out from under the still-active DMA engine."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/mediatek/mtk_plane.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "c410fa9b07c32cc69968ec83a148366d16c76dc4",
|
|
"lessThan": "df1ad5de2197ea1b527d13ae7b699e9ee7d724d4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c410fa9b07c32cc69968ec83a148366d16c76dc4",
|
|
"lessThan": "0eaa0a3dfe218c4cf1a0782ccbbc9e3931718f17",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c410fa9b07c32cc69968ec83a148366d16c76dc4",
|
|
"lessThan": "72223700b620885d556a4c52a63f5294316176c6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c410fa9b07c32cc69968ec83a148366d16c76dc4",
|
|
"lessThan": "9882a40640036d5bbc590426a78981526d4f2345",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/mediatek/mtk_plane.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.117",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.58",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.17.8",
|
|
"lessThanOrEqual": "6.17.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.6.117"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.12.58"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.17.8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.18"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/df1ad5de2197ea1b527d13ae7b699e9ee7d724d4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0eaa0a3dfe218c4cf1a0782ccbbc9e3931718f17"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/72223700b620885d556a4c52a63f5294316176c6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9882a40640036d5bbc590426a78981526d4f2345"
|
|
}
|
|
],
|
|
"title": "drm/mediatek: Disable AFBC support on Mediatek DRM driver",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |