Odebrany

CVE-2026-98517

opublikowano: 18.10.2026, 18:17

modyfikacja: 19.10.2026, 12:19

Ocena CVSS

n/a

Brak oceny

Oficjalne źródła

>_ Opis

Tłumaczenie automatyczne – może zawierać nieścisłości.

W jądrze Linuksa usunięto następującą lukę:

drm/nouveau/uvmm: napraw UAF w nouveau_uvmm_sm, gdy BO jest w TTM_PL_SYSTEM

nouveau_uvmm_sm() wywołuje op_map(), która przekazuje bo->zasoby
nouveau_mem() do nouveau_uvma_map(). nouveau_uvmm_vmm_map() następnie czyta
mem->mem.type.

Ale to jest ważne tylko wtedy, gdy bo->resource jest wspierany przez struct nouveau_mem,
podobnie jak w przypadku zasobów VRAM i TT. Jeśli BO zostanie pozostawione
TTM_PL_SYSTEM, bo->resource jest tylko strukturą ttm_resource. Leczenie tego
ponieważ struct nouveau_mem powoduje, że mem->mem.type jest odczytywany poza końcem
zasób powodujący KASAN: płyta-use-after-free Przeczytaj w nouveau_uvmm_sm
raport:

BŁĄD: KASAN: płyta-use-after-free w nouveau_uvmm_vmm_map sterowniki/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]
BŁĄD: KASAN: płyta-use-after-free w nouveau_uvma_map sterowniki/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]
BŁĄD: KASAN: płyta-use-after-free w op_map sterowniki/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]
BŁĄD: KASAN: płyta-use-after-free w nouveau_uvmm_sm.constprop.0+0x6ab/0x900 sterowniki/gpu/drm/nouveau/nouveau_uvmm.c:903
Odczytaj rozmiar 1 pod adresem ffff888127d3e3a0 przez zadanie kworker/0:1/11

Procesor: 0 UID: 0 PID: 11 Comm: kworker/0:1 Nieskażony 7.2.0 #5 PREEMPT(leniwy)
Nazwa sprzętu: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 01.04.2014
Kolejka robocza: nouveau_sched_wq_2224 drm_sched_run_job_work
Zadzwoń do śledzenia:
<ZADANIE>
__dump_stack lib/dump_stack.c:94 [w linii]
dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcb/0x5a0 mm/kasan/report.c:482
kasan_report+0xca/0x100 mm/kasan/report.c:595
nouveau_uvmm_vmm_map sterowniki/gpu/drm/nouveau/nouveau_uvmm.c:152 [wbudowane]
nouveau_uvma_map sterowniki/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]
op_map sterowniki/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]
nouveau_uvmm_sm.constprop.0+0x6ab/0x900 sterowniki/gpu/drm/nouveau/nouveau_uvmm.c:903
nouveau_uvmm_sm_unmap sterowniki/gpu/drm/nouveau/nouveau_uvmm.c:932 [wbudowane]
nouveau_uvmm_bind_job_run+0xd6/0x250 sterowniki/gpu/drm/nouveau/nouveau_uvmm.c:1532
nouveau_job_run sterowniki/gpu/drm/nouveau/nouveau_sched.c:350 [wbudowane]
nouveau_sched_run_job+0x62/0xd0 sterowniki/gpu/drm/nouveau/nouveau_sched.c:364
drm_sched_run_job_work+0x356/0xa10 sterowniki/gpu/drm/scheduler/sched_main.c:1061
proces_one_work+0x8a5/0x1900 jądro/workqueue.c:3322
Process_scheduled_works kernel/workqueue.c:3405 [inline]
wątek_pracownika+0x5dd/0xd80 jądro/workqueue.c:3486
kthread+0x31d/0x420 jądro/kthread.c:436
ret_from_fork+0x662/0x940 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</ZADANIE>

Przydzielone przez zadanie 2224 na procesorze 0 o godzinie 66,550027 s:
kasan_save_stack+0x24/0x50 mm/kasan/common.c:57
kasan_save_track+0x17/0x60 mm/kasan/common.c:78
trucizna_kmalloc_redzone mm/kasan/common.c:398 [w linii]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [w linii]
__do_kmalloc_node mm/slub.c:5334 [w linii]
__kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359
_kmalloc_noprof include/linux/slab.h:992 [w linii]
dma_resv_list_alloc+0x27/0x90 sterowniki/dma-buf/dma-resv.c:106
dma_resv_reserve_fences+0x60e/0xa30 sterowniki/dma-buf/dma-resv.c:205
ttm_bo_alloc_resource+0x12c/0xbd0 sterowniki/gpu/drm/ttm/ttm_bo.c:721
ttm_bo_validate+0x1bc/0x4a0 sterowniki/gpu/drm/ttm/ttm_bo.c:856
ttm_bo_init_reserved+0x2c3/0x570 sterowniki/gpu/drm/ttm/ttm_bo.c:970
nouveau_bo_init+0x159/0x2c0 sterowniki/gpu/drm/nouveau/nouveau_bo.c:359
nouveau_gem_new+0x234/0x5f0 sterowniki/gpu/drm/nouveau/nouveau_gem.c:272
nouveau_gem_ioctl_new+0x1eb/0x420 sterowniki/gpu/drm/nouveau/nouveau_gem.c:352
drm_ioctl_kernel+0x192/0x350 sterowniki/gpu/drm/drm_ioctl.c:817
drm_ioctl+0x4f8/0xb40 sterowniki/gpu/drm/drm_ioctl.c:914
nouveau_drm_ioctl+0xea/0x2c0 sterowniki/gpu/drm/nouveau/nouveau_drm.c:1338
vfs_ioctl fs/ioctl.c:51 [w linii]
__do_sys_ioctl fs/ioctl.c:597 [w linii]
__se_sys_ioctl fs/ioctl.c:583 [w linii]
__x64_sys_ioctl+0x180/0x1d0 fs/ioctl.c:583
do_syscall_x64 ar
---obcięty---

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM

nouveau_uvmm_sm() calls op_map(), which passes bo->resource through
nouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_vmm_map() then reads
mem->mem.type.

But this is only valid when bo->resource is backed by struct nouveau_mem,
as is the case for VRAM and TT resources. If the BO is left in
TTM_PL_SYSTEM, bo->resource is only a struct ttm_resource. Treating it
as struct nouveau_mem makes the mem->mem.type read past the end of the
resource, causing a KASAN: slab-use-after-free Read in nouveau_uvmm_sm
report:

BUG: KASAN: slab-use-after-free in nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]
BUG: KASAN: slab-use-after-free in nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]
BUG: KASAN: slab-use-after-free in op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]
BUG: KASAN: slab-use-after-free in nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903
Read of size 1 at addr ffff888127d3e3a0 by task kworker/0:1/11

CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nouveau_sched_wq_2224 drm_sched_run_job_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcb/0x5a0 mm/kasan/report.c:482
kasan_report+0xca/0x100 mm/kasan/report.c:595
nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]
nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]
op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]
nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903
nouveau_uvmm_sm_unmap drivers/gpu/drm/nouveau/nouveau_uvmm.c:932 [inline]
nouveau_uvmm_bind_job_run+0xd6/0x250 drivers/gpu/drm/nouveau/nouveau_uvmm.c:1532
nouveau_job_run drivers/gpu/drm/nouveau/nouveau_sched.c:350 [inline]
nouveau_sched_run_job+0x62/0xd0 drivers/gpu/drm/nouveau/nouveau_sched.c:364
drm_sched_run_job_work+0x356/0xa10 drivers/gpu/drm/scheduler/sched_main.c:1061
process_one_work+0x8a5/0x1900 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5dd/0xd80 kernel/workqueue.c:3486
kthread+0x31d/0x420 kernel/kthread.c:436
ret_from_fork+0x662/0x940 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>

Allocated by task 2224 on cpu 0 at 66.550027s:
kasan_save_stack+0x24/0x50 mm/kasan/common.c:57
kasan_save_track+0x17/0x60 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5334 [inline]
__kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359
_kmalloc_noprof include/linux/slab.h:992 [inline]
dma_resv_list_alloc+0x27/0x90 drivers/dma-buf/dma-resv.c:106
dma_resv_reserve_fences+0x60e/0xa30 drivers/dma-buf/dma-resv.c:205
ttm_bo_alloc_resource+0x12c/0xbd0 drivers/gpu/drm/ttm/ttm_bo.c:721
ttm_bo_validate+0x1bc/0x4a0 drivers/gpu/drm/ttm/ttm_bo.c:856
ttm_bo_init_reserved+0x2c3/0x570 drivers/gpu/drm/ttm/ttm_bo.c:970
nouveau_bo_init+0x159/0x2c0 drivers/gpu/drm/nouveau/nouveau_bo.c:359
nouveau_gem_new+0x234/0x5f0 drivers/gpu/drm/nouveau/nouveau_gem.c:272
nouveau_gem_ioctl_new+0x1eb/0x420 drivers/gpu/drm/nouveau/nouveau_gem.c:352
drm_ioctl_kernel+0x192/0x350 drivers/gpu/drm/drm_ioctl.c:817
drm_ioctl+0x4f8/0xb40 drivers/gpu/drm/drm_ioctl.c:914
nouveau_drm_ioctl+0xea/0x2c0 drivers/gpu/drm/nouveau/nouveau_drm.c:1338
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x180/0x1d0 fs/ioctl.c:583
do_syscall_x64 ar
---truncated---

>_ Referencje

Dane podatności pochodzą z oficjalnych źródeł (CVE® List / NVD). Opisy po polsku są tłumaczone automatycznie i mogą zawierać nieścisłości – na stronie rekordu można wyświetlić wersję angielską.

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.

NVD Terms of Use / CVE® Terms of Use / nvd.nist.gov / cve.org

<< baza_cve