CVE-2022-50454

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()

nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm will call nouveau_bo_del_ttm() and free the memory.Thus, when nouveau_bo_init() returns an error, the gem object has already been released. Then the call to nouveau_bo_ref() will use the freed "nvbo->bo" and lead to a use-after-free bug.

We should delete the call to nouveau_bo_ref() to avoid the use-after-free.

Red Hat Enterprise Linux is not affected by this vulnerability because the flawed code in the Nouveau graphics driver was never introduced into supported Red Hat kernels. Exploiting this issue would require local authenticated access with permissions to manipulate graphics buffer sharing endpoints on systems with affected hardware. On systems where the vulnerable code is present, triggering the error path could lead to an operating system crash or potential local privilege escalation.