Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id allocate_sdma_queue has an option where the sdma queue id can be specified (used by CRIU). We weren't bounds-checking that value. Confirm it's less than the maximum number of queues.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2485c12c980a36bb9e23ababb07d73c4ac6a45af to < 41460d2dd0246f0ab7e80b103d34c8649e022999affected2485c12c980a36bb9e23ababb07d73c4ac6a45af to < 25e1b29ecc8da3609ba0072ca54a3b1fdd1578f3affected2485c12c980a36bb9e23ababb07d73c4ac6a45af to < 42f2bd50236b61ad0aeb2c233c990ee0d615fdadaffected2485c12c980a36bb9e23ababb07d73c4ac6a45af to < dd2870ca036e1d51baa59f942007b36a595b5890affected2485c12c980a36bb9e23ababb07d73c4ac6a45af to < bfe9a7545b2a7be1c543f1741e16f2d5ec4116aeaffected
Linux Linux
Default version status: affected
5.18affected0 to < 5.18unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/41460d2dd0246f0ab7e80b103d34c8649e022999 ↗
- https://git.kernel.org/stable/c/25e1b29ecc8da3609ba0072ca54a3b1fdd1578f3 ↗
- https://git.kernel.org/stable/c/42f2bd50236b61ad0aeb2c233c990ee0d615fdad ↗
- https://git.kernel.org/stable/c/dd2870ca036e1d51baa59f942007b36a595b5890 ↗
- https://git.kernel.org/stable/c/bfe9a7545b2a7be1c543f1741e16f2d5ec4116ae ↗