oss-sec mailing list archives
Re: CVE Request - Samsung Exynos GPU driver OOB read
From: Greg KH <greg () kroah com>
Date: Fri, 20 Jan 2017 09:24:38 +0100
On Fri, Jan 20, 2017 at 12:19:34AM +0800, idl3r wrote:
Unfortunately, there is no official git for tracking from Samsung, so I can't give a pointer to the particular commit. The bug itself resides in <root>/drivers/gpu/arm/t7xx/r5p0/mali_kbase_core_linux.c of the src tree, in function kbase_dispatch which is the main ioctl dispatcher of the driver:
Ah, so this isn't upstream in the main kernel tree, thanks for letting me know, that's what I was most concerned about. Hopefully Samsung figures a way to push this change out to all of their users... :)
static mali_error kbase_dispatch(struct kbase_context *kctx, void * const args, u32 args_size) { ... /* setup complete, perform normal operation */ switch (id) { ... case KBASE_FUNC_TMU_SKIP: { /* MALI_SEC_INTEGRATION */ #ifdef CONFIG_SENSORS_SEC_THERMISTOR #ifdef CONFIG_USE_VSYNC_SKIP struct kbase_uk_tmu_skip *tskip = args; int thermistor = sec_therm_get_ap_temperature(); u32 i, t_index = tskip->num_ratiometer; for (i = 0; i < tskip->num_ratiometer; i++) <== missing of boundary check if (thermistor >= tskip->temperature[i]) t_index = i; tskip->temperature is a uint32 array of static size(10 elements) and tskip->num_ratiometer a uint32 which is user controlled. Since the boundary check is missing, OOB read may happen leading to possible memory corruption.
It's "user controlled" through the drm interface? Or something else? Anyway, no need for more details, this was great, thank you very much for the quick response. gre k-h
Current thread:
- CVE Request - Samsung Exynos GPU driver OOB read Idler (Jan 19)
- Re: CVE Request - Samsung Exynos GPU driver OOB read Greg KH (Jan 19)
- RE: CVE Request - Samsung Exynos GPU driver OOB read idl3r (Jan 19)
- Re: CVE Request - Samsung Exynos GPU driver OOB read Greg KH (Jan 20)
- RE: CVE Request - Samsung Exynos GPU driver OOB read idl3r (Jan 20)
- RE: CVE Request - Samsung Exynos GPU driver OOB read idl3r (Jan 19)
- Re: CVE Request - Samsung Exynos GPU driver OOB read Greg KH (Jan 19)
- Re: CVE Request - Samsung Exynos GPU driver OOB read cve-assign (Jan 19)