Executive Summary

This vulnerability exists in the Linux kernel's drm/v3d component, where a function called v3d_get_extensions() processes a userspace-provided singly-linked list of ioctl extensions without limiting the length of the chain.

A local user can exploit this by crafting a self-referential extension (where the extension's next pointer points to itself) with both in_sync_count and out_sync_count set to zero. This bypasses the existing guard that prevents duplicate extensions because the guard only triggers if either count is non-zero.

Since the function v3d_get_multisync_post_deps() returns immediately when these counts are zero, the loop never terminates, causing an infinite loop in kernel context. This infinite loop blocks the calling thread and causes a CPU core to be fully utilized indefinitely.

The fix involves rejecting any multisync extension where both in_sync_count and out_sync_count are zero, as such an extension carries no synchronization information and serves no useful purpose.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service condition on the affected system.

By exploiting the infinite loop in kernel context, a local user can block the calling thread and cause a CPU core to be fully consumed indefinitely, potentially degrading system performance or causing system instability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by rejecting multisync extensions where both in_sync_count and out_sync_count are zero in the Linux kernel's v3d driver. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

This prevents the infinite loop caused by a crafted self-referential extension that leads to CPU core pegging and blocking of the calling thread.

Useful 0 Not Useful 0