CVE-2018-20669

Published: 21 March 2019

An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation.

From the Ubuntu Security Team

Timothy Michaud discovered that the i915 graphics driver in the Linux kernel did not properly validate user memory locations for the i915_gem_execbuffer2_ioctl. A local attacker could possibly use this to cause a denial of service or execute arbitrary code.

Notes

Only the i915_gem_execbuffer2_ioctl() changes are technically needed
for this CVE. It would be ideal to audit the callers of the other changed
functions in the fix commit.
This CVE is being disputed. See the oss-security emails on
2019-02-07 for details.

while this specific ioctl may or may not be vulnerable, the
fix is generic aenough to possibly block other vulnerabilities.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20669
• https://www.openwall.com/lists/oss-security/2019/01/23/6
• https://www.openwall.com/lists/oss-security/2019/02/07/1
• https://ubuntu.com/security/notices/USN-4485-1
• NVD
• Launchpad
• Debian