Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a version where the vulnerability is fixed.

The fix replaces the WARN_ON(1) with an explicit -EINVAL return, preventing the ioctl from reaching hardware and stopping kernel log spam and potential denial-of-service.

If updating is not immediately possible, consider restricting unprivileged users' access to the DRM device to prevent exploitation.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Linux kernel's accel/ethosu driver, where it improperly handles the NPU_OP_RESIZE command from userspace. This command is specific to the U85 hardware but is not yet implemented by the driver. When userspace submits this command via DRM_IOCTL_ETHOSU_GEM_CREATE, the driver triggers a WARN_ON(1) placeholder unconditionally, which causes excessive kernel log spam.

If the kernel is configured with panic_on_warn enabled, this warning causes the kernel to panic, resulting in a denial-of-service condition. This means any unprivileged user with access to the DRM device can exploit this to crash the system.

The fix replaces the WARN_ON(1) with an explicit error return (-EINVAL), so the command is rejected before reaching the hardware, preventing the kernel panic and log spam.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by any unprivileged user who has access to the DRM device to cause a denial-of-service (DoS) attack by triggering a kernel panic.

The impact is that the system can become unstable or crash unexpectedly, leading to downtime and potential loss of availability of services running on the affected Linux system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring kernel logs for repeated WARN_ON(1) messages triggered by userspace submitting the NPU_OP_RESIZE command via DRM_IOCTL_ETHOSU_GEM_CREATE.

You can use commands like 'dmesg' or 'journalctl -k' to check for kernel log spam related to this warning.

• dmesg | grep WARN_ON
• journalctl -k | grep WARN_ON

Additionally, monitoring for kernel panics if panic_on_warn is enabled can indicate exploitation attempts.

Useful 0 Not Useful 0