GPU VulnDB

Database/NVIDIA / GPU stack

Linux kernel drm/ttm: resource leak on eviction error paths other than -EMULTIHOP

CVSS 7.8CVE-2023-54254NVIDIA / GPU stackcurated

Impact

TTM is the buffer-object memory manager shared by the amdgpu, nouveau and radeon DRM drivers. On an eviction failure returning anything other than -EMULTIHOP, the resource is leaked. On a GPU node this accrues inside the kernel's accounting of device memory as tenants churn buffer objects, and in the long run can leave VRAM or GTT accounted as in-use with no owner, degrading or failing allocations until the node is rebooted. The record describes a leak only - no memory-disclosure or code-execution path is shown.

Who can reach it

Local user with access to a DRM render node (/dev/dri/renderD*) that uses TTM - that is, any tenant with a GPU pod on an AMD or nouveau node. Authentication to the host is required; no remote path.

What to do

Update to a stable kernel carrying the drm/ttm fix (commits 6aea0032380b, 7738335d73d0, e8188c461ee0, e9c44738cb1f) and reboot each GPU node; the DRM driver cannot be reloaded under live GPU workloads, so this is a drain-and-reboot. No mitigation short of patching is described.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-54254https://git.kernel.org/stable/c/6aea0032380bbb1efebd598ad733d16925167921https://git.kernel.org/stable/c/7738335d73d0686ec8995e0448e5d1b48cffb2a4https://git.kernel.org/stable/c/e8188c461ee015ba0b9ab2fc82dbd5ebca5a5532

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.