In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/uapi: Reject coh_none PAT index for CPU cached memory in madvise<\/p>\n
Add validation in xe_vm_madvise_ioctl() to reject PAT indices with
\nXE_COH_NONE coherency mode when applied to CPU cached memory.<\/p>\n
Using coh_none with CPU cached buffers is a security issue. When the
\nkernel clears pages before reallocation, the clear operation stays in
\nCPU cache (dirty). GPU with coh_none can bypass CPU caches and read
\nstale sensitive data directly from DRAM, potentially leaking data from
\npreviously freed pages of other processes.<\/p>\n
This aligns with the existing validation in vm_bind path
\n(xe_vm_bind_ioctl_validate_bo).<\/p>\n
v2(Matthew brost)
\n– Add fixes
\n– Move one debug print to better place<\/p>\n
v3(Matthew Auld)
\n– Should be drm\/xe\/uapi
\n– More Cc<\/p>\n
v4(Shuicheng Lin)
\n– Fix kmem leak issues by the way<\/p>\n
v5
\n– Remove kmem leak because it has been merged by another patch<\/p>\n
v6
\n– Remove the fix which is not related to current fix<\/p>\n
v7
\n– No change<\/p>\n
v8
\n– Rebase<\/p>\n
v9
\n– Limit the restrictions to iGPU<\/p>\n
v10
\n– No change<\/p>\n
(cherry picked from commit 016ccdb674b8c899940b3944952c96a6a490d10a)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/uapi: Reject coh_none PAT index for CPU cached memory in madvise<\/p>\n
Add validation in xe_vm_madvise_ioctl() to reject PAT indi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-16003","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/16003","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16003"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16003"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16003"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}