amdkfd WaveState OOB

Vulnerability analysis

When an application asks the AMD compute driver to return the saved execution state of a GPU queue, the driver reads the size and offset of that state from metadata that is normally written by the GPU's own firmware. On the checkpoint/restore path, however, that metadata comes from a restored process image and is fully controlled by whoever supplies it. The driver trusted these values without checking them against the buffer it actually allocated, so a forged size or offset made it copy arbitrary amounts of kernel memory back to the caller — a large forged size leaks megabytes of neighbouring kernel data such as other queues' metadata and kernel pointers, while an offset larger than the size wraps around into a multi-gigabyte read that can run off the end of mapped memory and take the kernel down. The fix clamps the reported size and offset to the real allocated buffer before any data is copied, so the operation can never read past the queue's own allocation. The path is reachable by a local process using the AMD compute device (for example during a checkpoint/restore cycle of its own GPU workloads); it requires an AMD GPU supported by the v9 queue manager and the compute driver loaded, and is not reachable remotely or on hardware without that driver.