Linux kernel (drivers/gpu/drm/radeon): The radeon video-encode command-stream parser used an uninitialised stack value

Impact

The radeon video-encode command-stream parser used an uninitialised stack value as the size argument when validating a relocation, so a tenant that crafts an encode command stream whose first opcode is the encode command gets the bounds check performed against garbage. That turns the CS parser's relocation validation into a coin flip and opens the door to out-of-bounds buffer access driven entirely from the ioctl.

Who can reach it

A container holding /dev/dri/renderD* on a host with a radeon-class AMD GPU submits a hand-built VCE command stream through the CS ioctl. No privilege beyond the render node; conditional on the radeon driver being loaded and the GPU exposing VCE, so it does not apply to amdgpu-era or NVIDIA nodes.

What to do

Update to a kernel with the fix commits below. Interim: blacklist the radeon module on nodes that do not need it, or drop /dev/dri from untrusted containers on radeon hosts.

References