Description
In the Linux kernel, the following vulnerability has been resolved: drm: Account property blob allocations to memcg DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized property blobs backed by kernel memory. Currently, the blob data allocation is not accounted to the allocating process's memory cgroup, allowing unprivileged users to trigger unbounded kernel memory consumption and potentially cause system-wide OOM. Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory is properly charged to the caller's memcg. This ensures existing cgroup memory limits apply and prevents uncontrolled kernel memory growth without introducing additional policy or per-file limits.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e2f5d2ea479b9b2619965d43db70939589afe43a to < b6117210ed349356f8e6027ff020b4d620bca42baffectede2f5d2ea479b9b2619965d43db70939589afe43a to < 815fa29cab3c67bebb9d0b5f41145cdd3a14d04daffectede2f5d2ea479b9b2619965d43db70939589afe43a to < 866e0c1a9e7244d58ed74853cb22b81e1900cfddaffectede2f5d2ea479b9b2619965d43db70939589afe43a to < bbfaa5761f589a81031b493cb01275a990d6fb25affectede2f5d2ea479b9b2619965d43db70939589afe43a to < 8e1664b9ee43608eb973d357ae5d858d30cbc9caaffectede2f5d2ea479b9b2619965d43db70939589afe43a to < cb8b9a1755fe9f38e4fb7f287486d7e7fab3dba4affectede2f5d2ea479b9b2619965d43db70939589afe43a to < 405fd652d8fedff219a8f48daf8f20e881e303abaffectede2f5d2ea479b9b2619965d43db70939589afe43a to < 26b4309a3ab82a0697751cde52eb336c29c19035affected
Linux Linux
Default version status: affected
4.2affected0 to < 4.2unaffected5.10.252 to ≤ 5.10.*unaffected5.15.202 to ≤ 5.15.*unaffected6.1.165 to ≤ 6.1.*unaffected6.6.128 to ≤ 6.6.*unaffected6.12.75 to ≤ 6.12.*unaffected6.18.16 to ≤ 6.18.*unaffected6.19.6 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/b6117210ed349356f8e6027ff020b4d620bca42b ↗
- https://git.kernel.org/stable/c/815fa29cab3c67bebb9d0b5f41145cdd3a14d04d ↗
- https://git.kernel.org/stable/c/866e0c1a9e7244d58ed74853cb22b81e1900cfdd ↗
- https://git.kernel.org/stable/c/bbfaa5761f589a81031b493cb01275a990d6fb25 ↗
- https://git.kernel.org/stable/c/8e1664b9ee43608eb973d357ae5d858d30cbc9ca ↗
- https://git.kernel.org/stable/c/cb8b9a1755fe9f38e4fb7f287486d7e7fab3dba4 ↗
- https://git.kernel.org/stable/c/405fd652d8fedff219a8f48daf8f20e881e303ab ↗
- https://git.kernel.org/stable/c/26b4309a3ab82a0697751cde52eb336c29c19035 ↗