Bug 2400732 (CVE-2021-4460)

Summary:	CVE-2021-4460 kernel: Linux kernel: integer overflow and information disclosure via undefined shift operation in drm/amdkfd
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel’s AMD Kernel Fusion Driver (amdkfd) within the drm subsystem. When either get_num_sdma_queues() or get_num_xgmi_sdma_queues() returned 0, the driver performed a bit shift where the number of bits shifted equaled the operand width. Such a shift is undefined behavior in C and can lead to incorrect values being used in subsequent logic.A local user with the ability to exercise the affected kernel APIs could trigger unintended behavior in the DRM/AMD GPU driver, which may result in a kernel crash and impact system availability	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-10-01 12:04:16 UTC

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix UBSAN shift-out-of-bounds warning

If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up
doing a shift operation where the number of bits shifted equals
number of bits in the operand. This behaviour is undefined.

Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the
count is >= number of bits in the operand.

Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1472

Comment 1 Jon Moroney 2025-10-01 22:05:18 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025100114-CVE-2021-4460-aa71@gregkh/T