Описание
In the Linux kernel, the following vulnerability has been resolved:
drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
radeon_ring_restore() takes ownership of the data buffer allocated by
radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in
the non-restore branch; in the restore branch it relies on
radeon_ring_restore() to free it.
If radeon_ring_lock() fails, the function returned early without calling
kvfree(data), leaking the ring backup buffer on every GPU reset that
fails at the lock stage. During repeated GPU resets this causes
cumulative kernel memory exhaustion.
Free data before returning the error.
A flaw was found in the Linux kernel's drm/radeon component. When a Graphics Processing Unit (GPU) reset operation fails to acquire a necessary lock, a memory buffer is not properly released. Repeated occurrences of this issue can lead to a gradual depletion of kernel memory. This memory exhaustion can ultimately result in a system crash or denial of service.
Отчет
A flaw was found in the Linux kernel's drm/radeon driver, with low security impact for Red Hat products. When a GPU reset fails to acquire the ring lock, radeon_ring_restore() returns early without freeing the ring backup buffer allocated by radeon_ring_backup(), leaking kernel memory on every reset that fails at the lock stage. A local user able to trigger repeated GPU resets on systems using affected radeon graphics hardware could accumulate these leaks and gradually exhaust kernel memory, ultimately causing a system crash or denial of service. The kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, 9, and 10, as well as the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS, are affected; their resolution is currently deferred, so a fix will be delivered in a future planned update rather than immediately, and the residual risk remains a local, low-impact denial of service on systems with affected radeon graphics hardware. Although the CVSS:3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects the high availability impact, Red Hat's overall severity is low because exploitation requires local access and reliable triggering depends on GPU resets failing at the ring-lock stage.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeon_ring_restore() on lock failure radeon_ring_restore() takes ownership of the data buffer allocated by radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in the non-restore branch; in the restore branch it relies on radeon_ring_restore() to free it. If radeon_ring_lock() fails, the function returned early without calling kvfree(data), leaking the ring backup buffer on every GPU reset that fails at the lock stage. During repeated GPU resets this causes cumulative kernel memory exhaustion. Free data before returning the error.
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeon_ring_restore() on lock failure radeon_ring_restore() takes ownership of the data buffer allocated by radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in the non-restore branch; in the restore branch it relies on radeon_ring_restore() to free it. If radeon_ring_lock() fails, the function returned early without calling kvfree(data), leaking the ring backup buffer on every GPU reset that fails at the lock stage. During repeated GPU resets this causes cumulative kernel memory exhaustion. Free data before returning the error.
In the Linux kernel, the following vulnerability has been resolved: d ...
EPSS
5.5 Medium
CVSS3