Bug 1723860 (CVE-2019-12881) - CVE-2019-12881 kernel: NULL pointer dereference in i915_gem_userptr_get_pages allows local denial of service via crafted ioctl calls
Summary: CVE-2019-12881 kernel: NULL pointer dereference in i915_gem_userptr_get_pages...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-12881
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1832196 1832197 1832198 1832199
Blocks: 1723861
TreeView+ depends on / blocked
 
Reported: 2019-06-25 14:39 UTC by msiddiqu
Modified: 2020-10-27 00:16 UTC (History)
24 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel 4.15.0 on Ubuntu 18.04.2. The i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c could allow an attacker to corrupt the memory and crash the system if they have permission to issue an ioctl to a system with an i915 graphics card.
Clone Of:
Environment:
Last Closed: 2020-09-23 07:08:06 UTC
Embargoed:

Attachments (Terms of Use)

Description msiddiqu 2019-06-25 14:39:04 UTC 
i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact via crafted ioctl calls to /dev/dri/card0.


References:  
https://gist.github.com/oxagast/472866fb2c3d439e10499d7141d0a520
Comment 6 Wade Mealing 2019-07-15 00:34:16 UTC 
This flaw is rated as moderate, at this time i appears that
this is a null pointer derference and a local panic.  The attacker requires permissions to 
issue an ioctl to the device node which requires a local attacker (usually with an x11 login).
Comment 9 Wade Mealing 2020-10-27 00:16:14 UTC 
Red Hat and Intel were unable to reproduce this issue on the kernels provided.  We are unable to find the root cause in the code shipping by Red Hat Enterprise Linux or current Fedora.  If any additional information becomes available this bug could re-open, until then I think we can't ship a patch for a bug we can't see.

Closing as notaffected.
Note You need to log in before you can comment on or make changes to this bug.