Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object is

CVSS 7.8CVE-2022-48662Kernel, userspace & hypervisorcurated

Impact

A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object is freed on one path while another path still holds a reference to it, so a local user with GPU access can get the kernel to read or write freed memory. Exploitability varies by heap layout, but on a GPU node every such bug is reachable from inside a container that was granted /dev/dri - the same boundary that is supposed to separate tenants. Specific trigger: the GEM context link being manipulated outside reference protection, which i915_perf then follows into freed memory.

Who can reach it

Any local user or container with a DRM render node - i.e. any tenant that was scheduled a GPU. No privileged capability needed.

What to do

Fix ships in the Linux kernel. Update the kernel and reboot the node - in practice this is a drain plus reboot because the accelerator driver cannot be unloaded while jobs hold device file descriptors. No BIOS or firmware update needed.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-48662 https://git.kernel.org/stable/c/713fa3e4591f65f804bdc88e8648e219fabc9ee1

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.