i915 GEM Phys BO Pread/Pwrite Offset Handling Fix

Executive Summary

This vulnerability exists in the Linux kernel's drm/i915/gem component. It involves incorrect handling of physical buffer objects (phys BO) during pread and pwrite operations with an offset. Specifically, the function sg_page() returns a struct page pointer rather than a void pointer, which causes incorrect scaling of pread/pwrite operations for phys BO. As a result, when a non-zero offset is used, wrong parts of the buffer object (BO) could be accessed.

The issue affected platforms with overlay or cursor planes using physical mapping, particularly older hardware such as Gen3/945G/Lakeport.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause incorrect memory regions to be accessed during read or write operations on physical buffer objects in the graphics subsystem. This could potentially lead to data corruption or unintended data exposure if wrong parts of memory are accessed.

Since the issue affects graphics memory handling on certain older platforms, it might impact system stability or graphics rendering correctness on those systems.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by fixing the phys BO pread/pwrite with offset in the drm/i915/gem component. To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix (cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6).

Since the last impacted platforms are those with overlay or cursor planes using phys mapping such as Gen3/945G/Lakeport, ensure that your system is updated accordingly.

Useful 0 Not Useful 0