CVE-2024-53071

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Be stricter about IO mapping flags

The current panthor_device_mmap_io() implementation has two issues:

1. For mapping DRM_PANTHOR_USER_FLUSH_ID_MMIO_OFFSET,

panthor_device_mmap_io() bails if VM_WRITE is set, but does not clear

VM_MAYWRITE. That means userspace can use mprotect() to make the mapping

writable later on. This is a classic Linux driver gotcha.

I don't think this actually has any impact in practice:

When the GPU is powered, writes to the FLUSH_ID seem to be ignored; and

when the GPU is not powered, the dummy_latest_flush page provided by the

driver is deliberately designed to not do any flushes, so the only thing

writing to the dummy_latest_flush could achieve would be to make *more*

flushes happen.

2. panthor_device_mmap_io() does not block MAP_PRIVATE mappings (which are

mappings without the VM_SHARED flag).

MAP_PRIVATE in combination with VM_MAYWRITE indic

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References