Executive Summary

This vulnerability exists in the Linux kernel's drm/xe component where a function called xe_pat_index_get_coh_mode() accesses an array without properly checking if the index (pat_index) is within valid bounds.

When a user provides an invalid pat_index value through the madvise IOCTL, the function performs an out-of-bounds (OOB) kernel read from the xe->pat.table array. This happens because the validation function madvise_args_are_sane() calls xe_pat_index_get_coh_mode() without first verifying that pat_index is within the allowed range.

Although debug builds have a warning (WARN_ON) to catch this, production kernels still perform the unsafe array access, potentially allowing a malicious user to read kernel memory out-of-bounds.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a malicious user to trigger an out-of-bounds kernel memory read, which can lead to unauthorized disclosure of sensitive kernel memory contents.

Such unauthorized kernel memory reads can potentially expose sensitive information, aid in further attacks such as privilege escalation, or compromise system integrity.

Useful 0 Not Useful 0