CVE-2024-53071

What it actually does

The panthor_device_mmap_io() function fails to clear VM_MAYWRITE after rejecting VM_WRITE for the FLUSH_ID offset and does not require VM_SHARED, allowing mprotect() to later enable writes or permitting copy-on-write private mappings that trigger BUG() on fault via vmf_insert_pfn_prot().

Why it matters to the business

Linux systems using Panthor GPUs may experience kernel crashes or unexpected mapping behaviors that reduce system stability and could be leveraged for local privilege escalation or denial of service in graphics workloads.

How an attack unfolds

A local attacker opens the Panthor device, requests an IO mapping for the flush ID offset without write permissions, then either calls mprotect() to add write access or specifies MAP_PRIVATE; on subsequent access or fault the kernel either permits unauthorized writes (when GPU powered) or hits an unsupported private PFN mapping path causing a crash.

How to fix it

Upgrade the Linux kernel to commit 2604afd65043e8f9d4be036cb1242adf6b5723cf or later stable release containing the stricter VM_MAYWRITE clearing and VM_SHARED requirement in panthor_device_mmap_io().

How to confirm the fix worked

Confirm kernel source contains the updated panthor_device_mmap_io() checks for VM_MAYWRITE and VM_SHARED; attempt the reproducer mappings from the patch notes and verify neither mprotect escalation nor private-mapping BUG() occurs.

Typical attack path

1. Obtain local unprivileged shell on affected Linux system
2. Open DRM Panthor device file and invoke mmap with DRM_PANTHOR_USER_FLUSH_ID_MMIO_OFFSET
3. Either omit VM_SHARED or later invoke mprotect to set VM_WRITE
4. Trigger write or page fault to reach remap or vmf_insert_pfn_prot code path
5. Observe either ignored writes or kernel BUG() oops

How to detect it

Search kernel logs and crash dumps for BUG() messages originating from vmf_insert_pfn_prot when panthor mappings are involved; review audit logs for unexpected mprotect calls on DRM device mappings.

What your security team should do

• Apply the referenced kernel commit or distribution update as soon as available
• Restrict untrusted local users from accessing DRM render nodes until patched
• Monitor kernel logs for vmf_insert_pfn_prot BUG splats involving panthor