Bug 1436798 (CVE-2017-7294)

Summary:	CVE-2017-7294 kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()
Product:	[Other] Security Response	Reporter:	Vladis Dronov <vdronov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aquini, arm-mgr, bhu, dhoward, fhrbata, gansalmon, hwkernel-mgr, iboverma, ichavero, itamar, jforbes, jkacur, joelsmith, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, madhu.chinakonda, matt, mchehab, mcressma, mmilgram, nmurray, pholasek, plougher, rt-maint, rvrbovsk, slawomir, williams, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	An out-of-bounds write vulnerability was found in the Linux kernel's vmw_surface_define_ioctl() function, in the 'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:09:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1436802, 1437432, 1437894, 1437895, 1437896, 1437897, 1437898, 1437899, 1437900, 1437901, 1470097, 1695718, 1695787
Bug Blocks:	1392508

Description Vladis Dronov 2017-03-28 17:30:19 UTC

In was found that in the Linux kernel in vmw_surface_define_ioctl() function in 'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file, a 'req->mip_levels[i]' are user-controlled values which are not checked for the upper limit and are used to calculate 'num_sizes' parameter. Both the 'num_sizes' and the array are 'uint32_t' so it is possible to make 'num_sizes' overflow. Later 'mip_levels[i]' are used as the loop count. This can lead an oob-write and/or kernel lock up. 

Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

References:

http://seclists.org/oss-sec/2017/q1/688

Proposed patch:

https://lists.freedesktop.org/archives/dri-devel/2017-March/137094.html

Comment 1 Vladis Dronov 2017-03-28 17:33:32 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1436802]

Comment 8 Vladis Dronov 2017-03-31 12:38:11 UTC

Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code where the flaw was found is not present in this product.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Comment 9 errata-xmlrpc 2018-04-10 08:04:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:0676 https://access.redhat.com/errata/RHSA-2018:0676

Comment 10 errata-xmlrpc 2018-04-10 09:28:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1062 https://access.redhat.com/errata/RHSA-2018:1062