Linux kernel (drivers/gpu/drm/i915/gt): The GPU migration copy path used plain ints for sizes that a tenant controls

CVSS 7.8CVE-2022-49963Kernel, userspace & hypervisorcurated

Impact

The GPU migration copy path used plain ints for sizes that a tenant controls and fed the whole object size into a fixed-size mapping window, so any buffer object larger than the 8MB chunk size is copied incorrectly and objects past 64MB blow through the compression-block limit. Migration is how buffers move between VRAM and system memory, so the consequence is corrupted or partially-copied tenant data and out-of-range block counts on discrete Intel GPUs.

Who can reach it

A tenant container holding /dev/dri/renderD* on a discrete Intel GPU (DG2 class) only has to allocate large buffer objects and let them be evicted or swapped - the upstream reproducers are the stock GPU memory-swapping IGT tests with slightly larger object sizes. No privilege beyond the render node.

What to do

Boot a kernel carrying the i915 migration/CCS fix below. Interim: cap per-tenant buffer-object and VRAM sizes to keep large-object migration out of play, and avoid overcommitting VRAM so eviction is rare.

References

https://git.kernel.org/stable/c/97434cb55bd884bd268626ec41489f79b261b2d4 https://git.kernel.org/stable/c/8d905254162965c8e6be697d82c7dbf5d08f574d https://nvd.nist.gov/vuln/detail/CVE-2022-49963

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.