Linux kernel (drivers/gpu/drm/i915/gem): The access handler for a memory-mapped GEM object never bounds-checks the

CVSS 7.8CVE-2022-49261Kernel, userspace & hypervisorcurated

Impact

The access handler for a memory-mapped GEM object never bounds-checks the requested length before the memcpy, so a tenant can read and write kernel memory adjacent to the object's mapping. Out-of-bounds read gives another tenant's leftover buffer contents; out-of-bounds write gives kernel heap corruption from an unprivileged process.

Who can reach it

A tenant process holding /dev/dri/renderD* on an i915 GPU maps a GEM object and then drives the vm_access path against it (process_vm_readv/writev or ptrace-style access to its own mapping, which is what the public PoC does). No privilege beyond the render node, no display access needed.

What to do

Boot a kernel carrying the i915 vm_access bounds-check fix below. Interim: drop /dev/dri/renderD* from containers that do not need i915 acceleration; there is no runtime toggle that closes this path while the device node is exposed.

References

https://git.kernel.org/stable/c/89ddcc81914ab58cc203acc844f27d55ada8ec0e https://git.kernel.org/stable/c/312d3d4f49e12f97260bcf972c848c3562126a18 https://nvd.nist.gov/vuln/detail/CVE-2022-49261

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.