🇰🇷 한글 설명
Linux 커널의 DRM(Direct Rendering Manager)에서 DRM_IOCTL_MODE_CREATEPROPBLOB 시스템 콜이 메모리 cgroup에 계정하지 않아 일반 사용자가 커널 메모리를 무제한으로 할당할 수 있는 취약점입니다. 이를 통해 시스템 전체 메모리 부족(OOM) 상태를 유발할 수 있습니다.
💡 쉬운 설명
A Linux kernel vulnerability allows unprivileged users to allocate unlimited kernel memory through the DRM property blob creation feature without proper accounting. This can cause the entire system to run out of memory and crash.
🇺🇸 원문 (English)
In the Linux kernel, the following vulnerability has been resolved:
drm: Account property blob allocations to memcg
DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized
property blobs backed by kernel memory.
Currently, the blob data allocation is not accounted to the allocating
process's memory cgroup, allowing unprivileged users to trigger unbounded
kernel memory consumption and potentially cause system-wide OOM.
Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory
is properly charged to the caller's memcg. This ensures existing cgroup
memory limits apply and prevents uncontrolled kernel memory growth without
introducing additional policy or per-file limits.
📍 영향받는 시스템
Linux kernel versions before patch (affects all major distributions: Ubuntu, Debian, RedHat, Fedora, etc.)
⚔️ 공격 벡터
Local unprivileged user executing DRM_IOCTL_MODE_CREATEPROPBLOB ioctl with arbitrary large size parameter on systems with direct rendering capability
🛡️ 대응 방법
Update Linux kernel to patched version containing GFP_KERNEL_ACCOUNT accounting for property blob allocations
🔧 검증 코드
If GFP_KERNEL_ACCOUNT is present in kernel config, the patch is applied; otherwise, check your kernel version against the CVE patch availability date for your distribution
grep -i 'GFP_KERNEL_ACCOUNT' /boot/config-$(uname -r) 2>/dev/null && echo 'Patched' || (uname -r && echo 'Verify version against CVE-2026-43287 patch list')