Bug 1723860 (CVE-2019-12881)

Summary:	CVE-2019-12881 kernel: NULL pointer dereference in i915_gem_userptr_get_pages allows local denial of service via crafted ioctl calls
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bhu, blc, brdeoliv, dhoward, dvlasenk, esammons, fhrbata, hkrzesin, iboverma, jlelli, jross, jstancek, kernel-mgr, lgoncalv, matt, mcressma, mlangsdo, nmurray, rt-maint, rvrbovsk, williams, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel 4.15.0 on Ubuntu 18.04.2. The i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c could allow an attacker to corrupt the memory and crash the system if they have permission to issue an ioctl to a system with an i915 graphics card.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-23 07:08:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1832196, 1832197, 1832198, 1832199
Bug Blocks:	1723861

Description msiddiqu 2019-06-25 14:39:04 UTC

i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact via crafted ioctl calls to /dev/dri/card0.


References:  
https://gist.github.com/oxagast/472866fb2c3d439e10499d7141d0a520

Comment 6 Wade Mealing 2019-07-15 00:34:16 UTC

This flaw is rated as moderate, at this time i appears that
this is a null pointer derference and a local panic.  The attacker requires permissions to 
issue an ioctl to the device node which requires a local attacker (usually with an x11 login).

Comment 9 Wade Mealing 2020-10-27 00:16:14 UTC

Red Hat and Intel were unable to reproduce this issue on the kernels provided.  We are unable to find the root cause in the code shipping by Red Hat Enterprise Linux or current Fedora.  If any additional information becomes available this bug could re-open, until then I think we can't ship a patch for a bug we can't see.

Closing as notaffected.