Linux kernel amdkfd: unvalidated CRIU-restored IDs reach idr_alloc and can trigger a kernel WARN
Impact
The KFD checkpoint/restore path takes object IDs straight from userspace-supplied CRIU data and passes them to idr_alloc() without bounding them to INT_MAX. A restored ID above INT_MAX trips a WARN in the IDR layer; on a host booted with panic_on_warn that turns into a panic and a reboot. This is the AMD compute driver behind /dev/kfd, so the caller is anyone allowed to run ROCm workloads, and on a shared AMD GPU node one tenant's crafted restore image can take the whole node down with every other tenant's jobs on it. The record describes no memory corruption - Smatch flagged the unchecked userspace value and the fix returns -EINVAL - so treat this as availability, not escalation.
Who can reach it
Local user holding /dev/kfd who can invoke the KFD CRIU restore ioctl with attacker-chosen event and BO IDs. No authentication beyond access to the device node, which any GPU pod on a ROCm node has.
What to do
Pick up the stable commits listed in the record, which add INT_MAX validation before idr_alloc() in both restore paths. The record names no fixed release, only the commit ids. Deployment is a kernel update: drain the node and reboot. Where CRIU-based checkpointing of GPU jobs is not used, denying the restore ioctl or not exposing /dev/kfd to untrusted tenants removes the reachable path in the meantime.
References
Related entries
- GPU / accelerator firmware (VBIOS, GSP, NVSwitch): GPU-resident firmware sits below the host OS and is not coveredNCVD-0000-012-gpu-accelerator-firmware-vbios-g · GPU / accelerator firmware (VBIOS, GSP, NVSwitch)Unscored
- NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-001-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
- NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-003-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
- Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA): GPUs apply data-dependent losslessNCVD-2023-003-integrated-gpu-graphics-data-com · Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA)Unscored
- NVIDIA Confidential Computing (H100/H200/B100/B200/GB200) - CC-DevTools operating mode: NVIDIA GPU confidentialNCVD-2023-004-nvidia-confidential-computing-h1 · NVIDIA Confidential Computing (H100/H200/B100/B200/GB200) - CC-DevTools operating modeUnscored
- Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA): GPUs apply data-dependent losslessNCVD-2023-005-integrated-gpu-graphics-data-com · Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.